host-backend-attach.ts (fetchBackendCodeIdentity) refuses to attach to a
backend whose boot commit differs from its checkout, keyed on `commit` in
the public GET /api/health body -- the guard that keeps a serve that
outlived `hermes update` from being re-adopted. Nothing pinned the field:
renaming or dropping it would silently turn every attach into "unknown
commit". The test drives the real route through the web_server app and
pins presence (null off git) and the value source,
get_version_info().commit. Proven RED by renaming the field.
Review G4.
b10e12973e