Verify AWS releases and support immutable GitHub OIDC subjects

[michaelbawuah]

Change

• Embed the source commit SHA in the API image and report it on /health.
• Require the public API to report the released SHA and pass /ready before the AWS workflow declares success; preserve its rollback path when the check fails.
• Match the immutable owner/repository IDs GitHub includes in OIDC subjects for repositories created after July 15, 2026. ModelForge was created September 16, 2026; its previous name-only AWS trust condition would reject the release workflow's token. Make the IDs configurable for forks/transfers.
• Pass hosted proof's dispatch input through an environment variable and validate its environment name before use in a shell command.
• Document manual image build arguments, OIDC trust, and release verification.

Verification

• Focused health, demo proof, and production config tests passed locally.
• Ruff, YAML parsing, workflow Bash syntax, HCL parsing, Python compile checks, SHA predicate checks, and git diff --check passed locally.
• CI includes Terraform format/validate, Python, Go, container builds, and live Compose smoke; rerunning for the new Terraform commit.
• Live AWS verification awaits a deployed AWS environment and production credentials.

GitHub OIDC format reference: https://docs.github.com/en/actions/reference/security/oidc#immutable-subject-claims