fix(broker): /health reports the deployed sha (SOURCE_COMMIT) instead of unknown

The Dockerfile's ARG GIT_SHA=unknown default was baked into every image
and shadowed Coolify's runtime SOURCE_COMMIT, so /health always said
gitSha=unknown and the deployed version couldn't be verified. A literal
"unknown" now counts as unset and SOURCE_COMMIT (short) is used.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/broker/src/build-info.ts

@@ -2,9 +2,10 @@
  * Build info surfaced on /health.
  *
  * gitSha is resolved lazily:
- *   1. GIT_SHA env var (preferred — baked in at image build time)
- *   2. `git rev-parse --short HEAD` (dev)
- *   3. "unknown" if neither works
+ *   1. GIT_SHA env var (baked in at image build time), unless it's the "unknown" default
+ *   2. SOURCE_COMMIT (Coolify injects it at runtime), short form
+ *   3. `git rev-parse --short HEAD` (dev)
+ *   4. "unknown" if none works
  */
 
 const VERSION = "0.1.0";
@@ -14,8 +15,16 @@ let cachedSha: string | null = null;
 
 function resolveGitSha(): string {
   if (cachedSha !== null) return cachedSha;
-  if (process.env.GIT_SHA) {
-    cachedSha = process.env.GIT_SHA;
+  // The Dockerfile bakes GIT_SHA=unknown as its ARG default, so a literal
+  // "unknown" means "not provided" — fall through to Coolify's runtime
+  // SOURCE_COMMIT (full sha). /health read "unknown" in prod because of this.
+  const baked = process.env.GIT_SHA;
+  if (baked && baked !== "unknown") {
+    cachedSha = baked;
+    return cachedSha;
+  }
+  if (process.env.SOURCE_COMMIT) {
+    cachedSha = process.env.SOURCE_COMMIT.slice(0, 7);
     return cachedSha;
   }
   try {