Verify the deployed version during web updates

[emnl51]

Summary

• force Compose to recreate the Bert container after rebuilding
• require /health to report the expected release version before an update succeeds
• bake the release into BERT_BUILD_VERSION, which takes precedence over stale runtime APP_VERSION values from .env
• document that APP_VERSION must not be stored in .env
• add regression coverage for matching, mismatched, and runtime-overridden versions

Why

The update page could report succeeded while the Git commit was current but .env supplied an older APP_VERSION to the running container.

Validation

• 237 passed
• ruff check app/version.py scripts/jobtrack_updater.py tests/test_release_container.py tests/test_update_management.py