The build set no OCI labels, so the image inherited
org.opencontainers.image.revision from its base image and advertised a commit
from an unrelated repository. Production was found running an image labelled
with a SHA that does not exist in the app repo at all, and the deployed contents
had to be confirmed by reading files inside the container.

That matters here more than usual: these images are cosign-signed with SBOM and
provenance attached. A signature proves the bytes are unmodified, not that they
came from the source you believe — so a revision label naming the wrong commit
undercuts the audit trail the signing exists to provide.

The build now stamps revision, source, version and created explicitly.

Also two analyser findings in passing: a redundant nullsafe before ?? in
EdgeServiceReconciler, and a dead `ini_get() === false` branch in
ProcessLivenessProbe (memory_limit is a core directive, so it is never false).

Full suite green: 10,499 tests.

Split from e36d5298faae7f2f71fb6252bf0fe8f0db2f5cff