Add regression check that /health's commit field matches the real deployed HEAD

Context

Following up on need4deed-org/be#969 (be's `/health-check` was found to report a stale/fake sha instead of the real deployed commit, due to a missing build-arg plus a sealed secret overriding the image's baked-in value).

`fe`'s equivalent (`src/app/health/route.ts`, reporting `process.env.GIT_COMMIT_SHA`) was audited as part of that investigation and currently looks correct:

• `build-fe.yaml` resolves the real `git rev-parse HEAD` of the checked-out commit and forwards it via `build-args: GIT_COMMIT_SHA=...`.
• The Dockerfile threads it through `ARG`/`ENV` correctly into the runtime stage.
• `infra/secrets/prod/n4d-prod/fe-secret.yaml` has no `GIT_COMMIT_SHA` key, so nothing overrides the image's baked-in value at runtime (unlike be's prod secret, which does).

Ask

Since this correctness depends on several moving pieces (CI step, Dockerfile ARG threading, and the absence of a secret override) staying aligned, add a lightweight regression check so a future change to any of those doesn't silently reintroduce a stale/fake commit sha:

• A CI/smoke check (or e2e test, if fe gains a test runner) that builds/starts the app and asserts `GET /health`'s `commit` field is a full 40-char hex sha (not `unknown`, not empty).
• Optionally, once deployed, a manual/CI step comparing the running `/health` commit against the actual `git rev-parse HEAD` of the deployed branch, to also catch secret-override-style regressions in `infra`.

Also worth noting while here (not blocking, just spotted in passing): `src/app/_health/route.ts` and `src/app/health/route.ts` are identical duplicates — may be worth deduping or documenting why both exist.

Start with src/app/health/route.ts, build-fe.yaml, the Dockerfile, and infra/secrets/prod/n4d-prod/fe-secret.yaml to trace GIT_COMMIT_SHA from the checked-out commit to GET /health. Add a CI or smoke check that verifies the response commit is a non-empty 40-character hexadecimal SHA; if comparing against git rev-parse HEAD, document or automate that deployed check too.