feat: embed git hash in website and verify after CI deploy

- website/layouts/_partials/extend_head.html: injects <meta name="x-version">
  using HUGO_PARAMS_GITVERSION (set by Taskfile at build time)
- Taskfile: website-build sets HUGO_PARAMS_GITVERSION=<short HEAD>;
  new website-verify task runs scripts/website-verify.sh
- scripts/website-verify.sh: fetches homepage, retries 6x/10s, checks
  that the deployed version hash matches HEAD
- website.yml: Verify step after Deploy; scripts/website-verify.sh added
  to path trigger

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Taskfile.yml

@@ -329,10 +329,18 @@ tasks:
       - nix develop --command hugo server --source website -D
 
   website-build:
-    desc: Build the static website
+    desc: Build the static website (embeds current git hash via HUGO_PARAMS_GITVERSION)
+    env:
+      HUGO_PARAMS_GITVERSION:
+        sh: git rev-parse --short HEAD
     cmds:
       - nix develop --command hugo --source website --minify
 
+  website-verify:
+    desc: Check that the deployed site serves the current git version
+    cmds:
+      - scripts/website-verify.sh
+
   website-deploy:
     desc: Deploy the website via rsync to public_html
     deps: [website-build]