feat(settings): show the running build's version and commit in the admin panel

Nothing in the UI said which build was loaded. /api/version has reported
version, build and source_commit since the harness started versioning itself
apart from the public semver, but the only way to read it was to curl the
endpoint — so "is the preview actually running the commit I just merged?" took
a terminal to answer.

Pins a footer under the settings sidebar nav showing the registered version
(plus the harness build when it differs) and the short source commit, with the
full hash on hover. It sits outside the nav's scroll container so it stays at
the bottom-left, and it is .admin-only, so syncAdminVisibility() hides it from
non-admins the same way it hides the Admin nav group.

The commit resolves at import via `git rev-parse HEAD` and is the string
"unknown" when that fails — a read-only Docker tree with no .git. The footer
treats "unknown" as absent and stays hidden when nothing is left to show,
rather than printing it. The collapsed rail and the two narrow tab-rail
layouts hide it too: neither has a bottom-left to write in.

static/index.html

@@ -1532,6 +1532,15 @@
             <span>System</span>
           </button>
           </div>
+
+          <!-- Build provenance, pinned below the scrolling nav so it stays at
+               the bottom-left of the panel: the version this build registers
+               and the commit the running process actually loaded. Populated
+               from /api/version; stays hidden until that answers. -->
+          <div class="settings-sidebar-build admin-only" id="settings-sidebar-build" hidden>
+            <span class="settings-sidebar-build-version" id="settings-sidebar-build-version"></span>
+            <span class="settings-sidebar-build-commit" id="settings-sidebar-build-commit"></span>
+          </div>
         </div>
         <div class="settings-panels">