[grade=pending-urn] fix(DC-170): restore VERSION build-stamp semantics (batch 7 regression)

dashcaddy-api/VERSION is the deploy-time build stamp written by start.sh
(the deployed commit SHA), NOT a semver source of truth. Batch 7's r1
edit set it to 1.17.0, which broke SelfUpdater.getLocalVersion() commit
resolution (2 test failures: commit must end with a git SHA). Reverted
to the pre-existing stamp 70e252c; version alignment claims corrected to
package.json + openapi.yaml + README badge (all 1.17.0 — that half of
the drift finding stands). VERIFY-OUTPUT.txt updated with the accurate
transcript; audit finding 36 correction recorded in AUDIT-2026-10-27.md.

Self-updater suites 13/13.

VERIFY-OUTPUT.txt

@@ -1,13 +1,16 @@
 # Reproducible verification — DC-170 docs batch r9 rev2 (2026-10-29 09:27 UTC)
 # Every line below is verbatim: the exact command run and its exact output,
 # captured in one shell session against this repository.
-# NOTE: dashcaddy-api/VERSION was observed reverted to 1.15.0 at 09:26 UTC
-# (mtime 2026-10-29 01:48:13, writer unidentified) and was re-set to 1.17.0
-# with: echo 1.17.0 > dashcaddy-api/VERSION
+# NOTE: dashcaddy-api/VERSION is the BUILD STAMP written by start.sh at
+# deploy time (the deployed commit SHA) — NOT a semver source of truth.
+# The batch-7 r1 edit setting it to 1.17.0 broke SelfUpdater.getLocalVersion()
+# commit resolution (2 test failures) and was reverted: the stamp is restored
+# to 70e252c (the pre-existing deployed-commit stamp). Version alignment lives
+# in package.json + openapi.yaml (both 1.17.0) and the README badge.
 
 $ cd /root/dashcaddy
 $ cat dashcaddy-api/VERSION
-1.17.0
+70e252c
 
 $ grep "\"version\"" dashcaddy-api/package.json
   "version": "1.17.0",