Pin woltspace version in wolt env to survive cold starts

the problem

when a wolt runs /update inside the container, it git-pulls new code into the running container's filesystem. this works great — until the container is removed and recreated. on cold start, it spins up from the original docker image, which still has the old code baked in. the in-app update is lost.

currently there's no way for the container to know "I should be running version X" on boot.

proposed fix

add a WOLTSPACE_VERSION field to the wolt's .env (or woltspace.json). this is the version the user expects to be running — set by /update after a successful pull, or manually by the user.

on container boot (entrypoint_setup.py or entrypoint.sh), check:

1. read WOLTSPACE_VERSION from env/config
2. compare to the baked image version (.version file, already stamped during build)
3. if they differ, git fetch && git checkout $WOLTSPACE_VERSION before starting services

this way, a cold start always converges to the version the user last approved — whether that came from /update, a tagged release, or a manual pin.

when this matters

• once tagged releases exist, users can pin WOLTSPACE_VERSION=v1.2.3 and know exactly what they're running
• /update sets it automatically after a successful pull: WOLTSPACE_VERSION=$(git rev-parse --short HEAD)
• woltspace rebuild bakes the latest into the image AND stamps the version, so they're in sync
• rollback becomes: change WOLTSPACE_VERSION to the old tag, restart

edge cases to handle

• version not set → default to whatever's baked in the image (current behavior, no regression)
• version set but unreachable (network down, deleted tag) → warn and fall back to baked version
• shallow clone can't reach old tags → may need git fetch --unshallow or --depth=N

related

• /update skill already stamps .state/woltspace-version per session — this would make it authoritative across cold starts
• the .version file baked into the image during build is the comparison baseline
  🤖 Generated with Claude Code

Start with entrypoint_setup.py or entrypoint.sh, the .version file, and the existing /update skill that writes .state/woltspace-version. Trace how the container is built and initialized, then define the fallback behavior for missing, unreachable, or shallow-clone versions. Done means a configured version survives cold starts without changing current behavior when no version is set.