ci: pin the build clock to the commit, so an unchanged refresh publishes nothing

Milestone 362 step 1, closing #3265's root cause.

The weekly base refresh rewrote all three `:latest` tags on 2026-08-30 with
nothing changed in any of them. Not a cache miss — run 4934's log shows every
content step CACHED and both bases resolved to unchanged pinned digests.
buildkit stamps the image config with the wall clock of the build, so
identical layers get republished under a new config blob and therefore a new
manifest digest.

The cost is not storage, it is meaning: `:latest` moved on a calendar, so a
digest change stopped being evidence that anything was different. That is the
one thing a digest is any use for, and it is load-bearing here — the reuse
check, the `:c-<sha>` rollback story and any future redeploy signal all rest
on it.

SOURCE_DATE_EPOCH normalises `created` and the history timestamps, so the same
source produces the same config bytes and the same digest, and pushing it is a
registry no-op.

The value is routed through artifacts.sh's existing `newest()` rather than
taken from git separately. `revision`, `version` and now `epoch` are three
fields of ONE lookup, so they cannot drift into naming different commits — a
divergence that would stamp an image reproducibly against one commit while it
reported being another, with both values looking perfectly well-formed. Note
#3127 §2 is the record of what a second clock costs; this adds a view, not a
clock.

Also corrected: the build step comment and ci-requirements.md both described
the churn as current behaviour with the fix as a "likely" future. They now
describe what the file does.

Tests pin the property the fix depends on, not the fix: epoch is the same
commit version names, in both renderings including the extension's unpadded
one, and it does not move between two calls on one checkout. A future
refactor that gave epoch its own `git log` would pass every other test in
that file.

Not yet verified end to end — proving it needs two consecutive refreshes to
land on the same digest, which is the next thing, and is the step #3265 exists
because nobody did last time.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TTjbZZ6JirCMSaJzQV1RhA

scripts/artifacts.sh

@@ -90,7 +90,7 @@ DERIVER='scripts/artifacts.sh'
 
 
 usage() {
-  echo "usage: artifacts.sh {paths|revision|version} {web|ml|agent|extension}" >&2
+  echo "usage: artifacts.sh {paths|revision|version|epoch} {web|ml|agent|extension}" >&2
   exit 2
 }
 
@@ -149,6 +149,26 @@ cmd_revision() {
   echo "$(newest "$1")" | cut -d' ' -f2 | cut -c1-12
 }
 
+# The BUILD CLOCK: the same commit's unix timestamp, for SOURCE_DATE_EPOCH.
+#
+# buildkit stamps the image config's `created` field and every history entry
+# with the wall clock of the build unless this is set, so two builds of
+# identical source produce different config blobs and therefore different
+# manifest digests. That is #3265: the weekly refresh republished all three
+# `:latest` tags on 2026-08-30 with every content step CACHED and the bases
+# resolved to unchanged digests — nothing was different, and the digest moved
+# anyway. A digest that changes on a calendar cannot also mean "the content
+# changed", which is the only thing anyone wants it for.
+#
+# It is the same commit `revision` and `version` name — deliberately, and this
+# is the point of routing it through `newest()` rather than taking git's word
+# separately. Three values derived from three lookups can disagree; three
+# views of one lookup cannot. Note #3127 §2 is the record of what a second
+# clock costs.
+cmd_epoch() {
+  echo "$(newest "$1")" | cut -d' ' -f1
+}
+
 # The VERSION: `YYYY.MM.DD.HHMM`, zero-padded, UTC. One shape across the whole
 # family (note #3127 §1, rule 148) — the number an instance reports about
 # itself, and, with a `v` in front, the release tag naming the same build.
@@ -197,5 +217,6 @@ case "$1" in
   paths)    cmd_paths "$2" ;;
   revision) cmd_revision "$2" ;;
   version)  cmd_version "$2" ;;
+  epoch)    cmd_epoch "$2" ;;
   *)        usage ;;
 esac