ci: make the branch strategy enforced instead of merely intended

Same guard as the four site repos. myAi was the ONLY stack that kept its
environment variables through the 26 July migration, so it alone deployed
correctly all along -- but it shares the ${IMAGE_TAG:-staging} default that
made the others fail silently, so it gets the same treatment.

1. ${IMAGE_TAG:-staging} -> ${IMAGE_TAG:-IMAGE_TAG-NOT-SET} on all eight
   images: an unconfigured stack fails the pull rather than quietly becoming
   staging.

2. A smoke job that asks the deploy host what commit it serves, via a
   /version.json stamped into the web image at build time.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpTYCBLH58XzrM7n3xPJ5N

web/Dockerfile

@@ -16,4 +16,13 @@ EXPOSE 8080
 ENV ASPNETCORE_URLS=http://0.0.0.0:8080
 
 COPY --from=build /app/publish .
+
+# Stamp the commit into the image so a deploy can be verified from the outside.
+#
+# Without this a smoke test can only ask "does the site return 200?" -- which it did
+# throughout the month production was quietly serving staging images. A status check
+# cannot tell one build from another; /version.json can, so the smoke job refuses to
+# pass until the host is actually serving THIS commit.
+ARG GIT_SHA=unknown
+RUN mkdir -p wwwroot && printf '{"version":"%s"}' "$GIT_SHA" > wwwroot/version.json
 ENTRYPOINT ["dotnet", "web.dll"]