MQ-203-01: the build step reads the version from the running service's /health on the bind address before the checkout changes, resolves it to a commit and records that as the rollback SHA, instead of the checkout's HEAD, which can be ahead of production after a failed or deferred deploy. A running version of dev or *-dirty fails the step. The rollback and its migration check use that SHA. MQ-203-02: after checkout the build step fails on modified tracked files outside internal/frontend/dist (the Makefile's GIT_DIRTY predicate), and inspects the exact tag make docker produces, computed as the Makefile's VERSION including -dirty. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>