feat(settings): show the running build's version and commit in the admin panel

Nothing in the UI said which build was loaded. /api/version has reported
version, build and source_commit since the harness started versioning itself
apart from the public semver, but the only way to read it was to curl the
endpoint — so "is the preview actually running the commit I just merged?" took
a terminal to answer.

Pins a footer under the settings sidebar nav showing the registered version
(plus the harness build when it differs) and the short source commit, with the
full hash on hover. It sits outside the nav's scroll container so it stays at
the bottom-left, and it is .admin-only, so syncAdminVisibility() hides it from
non-admins the same way it hides the Admin nav group.

The commit resolves at import via `git rev-parse HEAD` and is the string
"unknown" when that fails — a read-only Docker tree with no .git. The footer
treats "unknown" as absent and stays hidden when nothing is left to show,
rather than printing it. The collapsed rail and the two narrow tab-rail
layouts hide it too: neither has a bottom-left to write in.

static/css/cookbook-research-memory-settings.css

@@ -1171,6 +1171,38 @@ details.hwfit-serve-advanced label:has(.hwfit-sf[data-field="vllm_kv_cache_dtype
   overflow-y: auto;
   overflow-x: hidden;
 }
+/* Build provenance at the bottom of the sidebar. The nav above it takes the
+   free space, so this needs no absolute positioning to sit at the bottom.
+   `[hidden]` needs restating: an author `display` rule outranks the UA
+   stylesheet's [hidden] rule, so the attribute alone would not hide it. */
+.settings-sidebar-build {
+  display: flex;
+  min-width: 0;
+  flex: 0 0 auto;
+  flex-direction: column;
+  gap: 1px;
+  margin-top: 8px;
+  padding: 4px 12px 2px;
+  border-top: 1px solid var(--border);
+  font-size: 9px;
+  color: color-mix(in srgb, var(--fg) 45%, transparent);
+}
+.settings-sidebar-build[hidden] {
+  display: none;
+}
+/* Same treatment as the "Admin" group label this sits under. */
+.settings-sidebar-build-version {
+  font-weight: 600;
+  letter-spacing: 1px;
+  text-transform: uppercase;
+}
+.settings-sidebar-build-commit {
+  overflow: hidden;
+  font-variant-numeric: tabular-nums;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  opacity: 0.75;
+}
 .settings-nav-search-wrap {
   position: relative;
   margin: 0 0 8px;
@@ -1326,6 +1358,9 @@ body.settings-sidebar-resize-active {
 .settings-sidebar.settings-sidebar-collapsed .settings-sidebar-content {
   display: none;
 }
+.settings-sidebar.settings-sidebar-collapsed .settings-sidebar-build {
+  display: none;
+}
 .settings-sidebar.settings-sidebar-collapsed .settings-sidebar-resize-handle {
   display: none;
 }
@@ -1356,7 +1391,8 @@ body.settings-sidebar-resize-active {
 
   .settings-nav-search-wrap,
   .settings-sidebar-resize-handle,
-  .settings-sidebar-toggle {
+  .settings-sidebar-toggle,
+  .settings-sidebar-build {
     display: none;
   }
 
@@ -1384,7 +1420,8 @@ body.settings-sidebar-resize-active {
 
   .settings-nav-search-wrap,
   .settings-sidebar-resize-handle,
-  .settings-sidebar-toggle {
+  .settings-sidebar-toggle,
+  .settings-sidebar-build {
     display: none;
   }
 }

static/index.html

@@ -1532,6 +1532,15 @@
             <span>System</span>
           </button>
           </div>
+
+          <!-- Build provenance, pinned below the scrolling nav so it stays at
+               the bottom-left of the panel: the version this build registers
+               and the commit the running process actually loaded. Populated
+               from /api/version; stays hidden until that answers. -->
+          <div class="settings-sidebar-build admin-only" id="settings-sidebar-build" hidden>
+            <span class="settings-sidebar-build-version" id="settings-sidebar-build-version"></span>
+            <span class="settings-sidebar-build-commit" id="settings-sidebar-build-commit"></span>
+          </div>
         </div>
         <div class="settings-panels">
 

static/js/settings/sidebar.js

@@ -121,10 +121,88 @@ export function setSettingsSidebarWidth(modalEl, width, options = {}) {
   return next;
 }
 
+/* ── Build provenance ──
+   The bottom-left of the panel answers "which build am I actually looking
+   at": the version this build registers and the commit its process loaded.
+   Both come from /api/version, which resolves the commit once at import via
+   `git rev-parse HEAD` and reports the string "unknown" when it cannot — a
+   read-only Docker tree with no .git, for instance. */
+const BUILD_COMMIT_SHORT_LEN = 8;
+const BUILD_UNKNOWN = 'unknown';
+const BUILD_COMMIT_SHA = /^[0-9a-f]{7,64}$/i;
+
+function buildField(value) {
+  const text = String(value ?? '').trim();
+  return text && text.toLowerCase() !== BUILD_UNKNOWN ? text : '';
+}
+
+/** Turn an /api/version payload into the two sidebar lines, or null when it
+ *  carries nothing worth a footer. */
+export function formatSettingsBuildInfo(payload) {
+  const version = buildField(payload?.version);
+  const build = buildField(payload?.build);
+  const commit = buildField(payload?.source_commit);
+
+  const parts = [];
+  if (version) parts.push(`v${version}`);
+  // The preview harness versions itself separately from the public semver, so
+  // show both — but never the same number twice.
+  if (build && build !== version) parts.push(`build ${build}`);
+
+  // An ODYSSEUS_SOURCE_COMMIT override need not be a sha; leave those intact
+  // and let the CSS ellipsis deal with the width.
+  const commitLabel = BUILD_COMMIT_SHA.test(commit)
+    ? commit.slice(0, BUILD_COMMIT_SHORT_LEN).toLowerCase()
+    : commit;
+
+  if (!parts.length && !commitLabel) return null;
+
+  return {
+    versionLabel: parts.join(' \u00b7 '),
+    commitLabel,
+    commitTitle: commit,
+  };
+}
+
+function paintSettingsBuildInfo(modalEl, info) {
+  const host = modalEl?.querySelector('#settings-sidebar-build');
+  if (!host) return;
+
+  const versionEl = host.querySelector('#settings-sidebar-build-version');
+  const commitEl = host.querySelector('#settings-sidebar-build-commit');
+
+  if (!info) {
+    host.hidden = true;
+    return;
+  }
+
+  if (versionEl) versionEl.textContent = info.versionLabel;
+  if (commitEl) {
+    commitEl.textContent = info.commitLabel;
+    // The short hash is what fits; keep the full one reachable on hover.
+    if (info.commitTitle) commitEl.title = info.commitTitle;
+  }
+
+  host.hidden = false;
+}
+
+async function loadSettingsBuildInfo(modalEl) {
+  try {
+    const res = await fetch('/api/version', { credentials: 'same-origin' });
+    if (!res.ok) return;
+    paintSettingsBuildInfo(modalEl, formatSettingsBuildInfo(await res.json()));
+  } catch {
+    // Provenance is informational: a failed probe leaves the footer hidden
+    // rather than putting an error in the middle of the settings nav.
+  }
+}
+
 export function bindSettingsSidebar(modalEl) {
   if (!modalEl || _bound.has(modalEl)) return;
   _bound.add(modalEl);
 
+  loadSettingsBuildInfo(modalEl);
+
   const sidebar = modalEl.querySelector('.settings-sidebar');
   const handle = modalEl.querySelector('#settings-sidebar-resize-handle');
   const toggle = modalEl.querySelector('#settings-sidebar-toggle');