The deploy job exports MANGALORD_TAG in-shell only, so .env kept its `latest` placeholder and the live SHA was only visible via docker inspect. sed the built SHA into .env after a successful `up -d` (non-fatal) so .env reflects what's actually deployed and manual `docker compose up` is deterministic. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>