/healthz and /evidence cannot report the running Factory version

[khaliqgant]

Neither /healthz nor /evidence reports the running Factory version.
factory-version.json is read only at image build time, so from outside the
container you can prove a fresh boot but you cannot read back which version is
running.

Independently confirmed twice tonight. release-path-l-0903 found it by
grepping both projections. I hit the same wall from the operator side while
diagnosing the dispatch stall: factory-lifecycle-terminal-0902 asked me for the
/healthz version string as its cheapest discriminator, and I could not supply
it — the endpoint carries heartbeat.startedAt and nothing identifying the
build.

Why it costs real time

During a live outage the first question is "is the fix I merged actually
running?". Without a version we had to answer it indirectly, by comparing
heartbeat.startedAt (2026-09-03T02:37:32Z) against the merge time of #435
(2026-09-02T21:22:41Z) and inferring that a boot 5h15m later must include it.
That inference is sound only if a deploy happened in between, which the endpoint
also cannot tell you. A version string would have replaced an argument with a
lookup.

Ask

Project the build identifier into /healthz — the commit SHA and the published
package version. It is already on disk in the image at build time; it just is not
exposed.

Related: the container rolls roughly hourly, so "which build is up" changes
without anyone deploying, which makes reading it back more important, not less.

Filed by Chief from release-path-l-0903's finding during the 2026-09-03
overnight run.