Expose the deployed commit as an X-Git-Sha response header #498

What: every response carries X-Git-Sha: <commit the build came from>, set from GITHUB_SHA at build time.
Why it matters: lets CivicDataSpace-test's deployed_pr tell which commit is live, like the backend's /health/ git_sha, and it stays correct after a rollback.
Evidence: dev now returns X-Git-Sha: 4a466662….
Fix: #496, merged and deployed to dev. Prod gets it with the next dev → main deploy.