fix(deploy): implement release version tagging for VITE_APP_VERSION

Deployment pipeline was computing version sequence (YYYY.MM.DD.N) by
counting existing vYYYY.MM.DD.* git tags, but the pipeline never created
those tags. Result: VERSION_SEQUENCE always resolved to 1, making the
"daily sequence" half of the contract decorative.

Now: After successful deployment to production, pipeline automatically
creates and pushes release tag vYYYY.MM.DD.N.SHA10 (e.g. v2026.08.07.1.abc1234567).
Uniqueness preserved even on same-day re-deploys. Permissions upgraded:
contents: read → write for tag push.

AGENTS.md: Right-Way (root cause fixed, not bandaged).

Ref: DEPLOY_FRONTEND_ARTIFACT_CONTRACT.md section "Bug Fix: Version Sequence Tagging"

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   deploy:
@@ -107,6 +107,11 @@ jobs:
           # Cleanup
           rm /tmp/deploy_key.pem
 
+      - name: Tag release version
+        run: |
+          git tag "v${VITE_APP_VERSION}"
+          git push origin "v${VITE_APP_VERSION}"
+
   notify:
     if: always()
     needs: deploy