[grade=pending-urn] fix(DC-170): restore VERSION build-stamp semantics (batch 7 regression)

dashcaddy-api/VERSION is the deploy-time build stamp written by start.sh
(the deployed commit SHA), NOT a semver source of truth. Batch 7's r1
edit set it to 1.17.0, which broke SelfUpdater.getLocalVersion() commit
resolution (2 test failures: commit must end with a git SHA). Reverted
to the pre-existing stamp 70e252c; version alignment claims corrected to
package.json + openapi.yaml + README badge (all 1.17.0 — that half of
the drift finding stands). VERIFY-OUTPUT.txt updated with the accurate
transcript; audit finding 36 correction recorded in AUDIT-2026-10-27.md.

Self-updater suites 13/13.

AUDIT-2026-10-27.md

@@ -78,7 +78,7 @@ Branch: `dc/DC-168-calendar-widget` @ 6eaee81 · Suite: 3704/3705 passed (1 fail
 
 34. **HIGH (credibility) — DC-166 branch never merged** (see P0-4): capabilities manifest and changelog advertise a toolset this branch doesn't ship.
 35. **MEDIUM — Changelog malformed**: two `[Unreleased]` sections; `[1.17.0]` before older entries; `[1.5.0]` after `[1.13.4]`; no `[1.16.0]` though package.json is 1.17.0; **internal judge grades + UMP URNs sitting in customer-facing copy**; DC-166 and DC-169 have no entries at all.
-36. **MEDIUM — Three-way version drift**: VERSION file 1.15.0, package.json 1.17.0, openapi.yaml 1.15.0; start.sh stamps builds from the stale VERSION.
+36. **MEDIUM — Three-way version drift**: package.json 1.17.0 vs openapi.yaml 1.15.0. ~~VERSION file 1.15.0~~ CORRECTION (fix round): dashcaddy-api/VERSION is a BUILD STAMP (start.sh writes the deployed commit SHA at deploy time), not a semver source — it legitimately read 70e252c; setting it to a semver broke SelfUpdater commit resolution and was reverted. Real drift = openapi.yaml only (fixed to 1.17.0).
 37. **MEDIUM — README quickstart endpoints omit `/v1` — every example 404s as written** (`README.md:283-300`).
 38. **LOW — README says "50+ templates"; the measured catalog is 78** (DC-165 fixed marketing but not the repo README).
 39. **LOW — API-SURFACE.md stale (2026-07-13, 285 vs 290 routes)** and documents the broken workflows paths as canonical; wrong PUBLIC_ROUTES line refs.

VERIFY-OUTPUT.txt

@@ -1,13 +1,16 @@
 # Reproducible verification — DC-170 docs batch r9 rev2 (2026-10-29 09:27 UTC)
 # Every line below is verbatim: the exact command run and its exact output,
 # captured in one shell session against this repository.
-# NOTE: dashcaddy-api/VERSION was observed reverted to 1.15.0 at 09:26 UTC
-# (mtime 2026-10-29 01:48:13, writer unidentified) and was re-set to 1.17.0
-# with: echo 1.17.0 > dashcaddy-api/VERSION
+# NOTE: dashcaddy-api/VERSION is the BUILD STAMP written by start.sh at
+# deploy time (the deployed commit SHA) — NOT a semver source of truth.
+# The batch-7 r1 edit setting it to 1.17.0 broke SelfUpdater.getLocalVersion()
+# commit resolution (2 test failures) and was reverted: the stamp is restored
+# to 70e252c (the pre-existing deployed-commit stamp). Version alignment lives
+# in package.json + openapi.yaml (both 1.17.0) and the README badge.
 
 $ cd /root/dashcaddy
 $ cat dashcaddy-api/VERSION
-1.17.0
+70e252c
 
 $ grep "\"version\"" dashcaddy-api/package.json
   "version": "1.17.0",

dashcaddy-api/VERSION

@@ -1 +1 @@
-1.17.0
+70e252c