feat: embed git hash in website and verify after CI deploy

- website/layouts/_partials/extend_head.html: injects <meta name="x-version">
  using HUGO_PARAMS_GITVERSION (set by Taskfile at build time)
- Taskfile: website-build sets HUGO_PARAMS_GITVERSION=<short HEAD>;
  new website-verify task runs scripts/website-verify.sh
- scripts/website-verify.sh: fetches homepage, retries 6x/10s, checks
  that the deployed version hash matches HEAD
- website.yml: Verify step after Deploy; scripts/website-verify.sh added
  to path trigger

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/website.yml

@@ -5,6 +5,7 @@ on:
     branches: [main]
     paths:
       - 'website/**'
+      - 'scripts/website-verify.sh'
       - '.forgejo/workflows/website.yml'
 
 jobs:
@@ -40,3 +41,6 @@ jobs:
           SSH_USER: ${{ secrets.WEBSITE_SSH_USER }}
           SSH_HOST: ${{ secrets.WEBSITE_SSH_HOST }}
         run: nix develop --command task website-deploy
+
+      - name: Verify
+        run: nix develop --command task website-verify