I-12: fail the build when COMMIT_SHA is empty

/version went null after a deploy — the exact "service cannot name its own
commit" defect this project was built to prevent, caught by its own honesty
check.

Cause: the sed replaced "" with "" (a no-op when COMMIT_SHA is empty) and the
grep then matched that same empty string, so the guard verified nothing. A build
with no COMMIT_SHA passed and shipped a container reporting commit_sha: null.

Now the build fails loudly instead.

Second cause of the stale deploy, and it was mine: an earlier `git commit
--amend` + force-push rewrote history the Veron deploy checkout was already
sitting on, leaving it divergent so `git pull -q` failed SILENTLY (-q hid
"Need to specify how to reconcile divergent branches"). Two lessons: do not
force-push a branch a deploy checkout tracks, and do not pull with -q in a
deploy script.

Co-Authored-By: Claude (Fable 5) <noreply@anthropic.com>

api/tests/test_invariants.py

@@ -694,3 +694,12 @@ async def test_security_no_bearer_is_still_401():
     with _pytest.raises(RepairPointer) as exc:
         await get_caller(req, authorization=None, x_service_token=None)
     assert exc.value.status_code == 401
+
+
+def test_i12_build_fails_when_commit_sha_is_empty():
+    """The sed+grep pair silently accepted an empty COMMIT_SHA: it replaced ""
+    with "" and then matched that same empty string, shipping a container that
+    reported commit_sha: null. That is the exact defect I-12 exists to prevent,
+    and it happened on 2026-08-14."""
+    df = (ROOT / "Dockerfile").read_text()
+    assert 'test -n "${COMMIT_SHA}"' in df