fix(engine): make .seed_version marker authoritative (no boot refusal)

The seed-drift guard shipped as refuse-boot: the backend exited when
BACKEND_DICT_VERSION disagreed with the flat dir's recorded .seed_version. On
the test contour that turned a harmless-in-intent action — bumping the
TEST_DICT_VERSION variable to the active release (v1.2.1) on a volume seeded as
v1.0.0 — into a crash loop, because DICT_VERSION is the *seed* of a fresh
volume, not the active version (which the admin console drives).

Make the marker authoritative instead: OpenWithVersions resolves the flat dir's
version from .seed_version when present and ignores bootVersion on an
already-seeded volume; bootVersion only seeds a fresh volume's marker. So a
bumped build seed on a live volume is a no-op (it can't relabel live bytes and
can't void games pinned to the prior label), and it correctly seeds the next
fresh volume. The subdirectory scan now skips the resolved seed, so a version
also present as a subdir (e.g. v1.2.1 uploaded via the console while the build
seed is bumped to v1.2.1) is still loaded rather than shadowed by the flat bytes.

Tests: marker-wins over a bumped boot version; a bumped boot keeps the matching
subdir resident (the live-contour case). Docs updated (ARCHITECTURE §5, READMEs,
compose/.env, PRERELEASE DV) from "refuses to boot" to "marker wins / ignored".

Verified locally against v1.2.1: gofmt, build, vet, unit, integration green.

deploy/.env.example

@@ -13,9 +13,9 @@ POSTGRES_PASSWORD=change-me            # required
 # scrabble-dictionary release tag baked into the image as the SEED dictionary for a
 # FRESH volume (image build-arg; also labels the resident seed version). After first
 # boot the dawg-data volume preserves versions uploaded through the admin console and
-# the active version lives in the DB. On a live volume the backend refuses to start if
-# this no longer matches the recorded seed (the seed-drift guard) — change a running
-# contour's dictionary through /_gm/dictionary, not by bumping this (ARCHITECTURE.md §5).
+# the active version lives in the DB. On a live volume a changed value is ignored (the
+# recorded .seed_version marker wins — the seed-drift guard); change a running
+# contour's dictionary through /_gm/dictionary (ARCHITECTURE.md §5).
 DICT_VERSION=v1.2.1
 
 # --- Logging ----------------------------------------------------------------

deploy/README.md

@@ -71,7 +71,7 @@ compose, but the connector **fails at boot** when it is empty.
 | --- | --- | --- | --- |
 | `POSTGRES_DB` | variable | `scrabble` | Database name. |
 | `POSTGRES_USER` | variable | `scrabble` | Database user. |
-| `DICT_VERSION` | variable | `v1.2.1` | `scrabble-dictionary` release tag baked into the backend image as the **seed for a fresh volume** (build-arg). A live contour changes dictionary through the admin console, not this; the backend refuses to boot if it drifts from the volume's recorded `.seed_version` (the seed-drift guard, ARCHITECTURE.md §5). Set per contour as `TEST_`/`PROD_DICT_VERSION`. |
+| `DICT_VERSION` | variable | `v1.2.1` | `scrabble-dictionary` release tag baked into the backend image as the **seed for a fresh volume** (build-arg). A live contour changes dictionary through the admin console, not this; on a seeded volume a changed value is ignored (the recorded `.seed_version` marker wins — the seed-drift guard, ARCHITECTURE.md §5). Set per contour as `TEST_`/`PROD_DICT_VERSION`. |
 | `LOG_LEVEL` | variable | `info` | Shared log level for backend / gateway / connector (`debug\|info\|warn\|error`). |
 | `CADDY_SITE_ADDRESS` | variable | `:80` | Caddy site address. Test: `:80` (host caddy terminates TLS). Prod: a domain, so caddy does its own ACME. |
 | `GM_BASICAUTH_USER` | variable | `gm` | Username for the `/_gm` Basic-Auth. |

deploy/docker-compose.yml

@@ -97,9 +97,9 @@ services:
     # inherits). The admin console writes new version subdirectories here, and the
     # volume preserves them — and the versions in-progress games pin — across
     # redeploys. Once seeded the volume is not re-seeded: DICT_VERSION is the seed for
-    # a FRESH volume only. On a live volume the backend refuses to start if DICT_VERSION
-    # no longer matches the recorded seed (the seed-drift guard), so a running contour's
-    # dictionary is changed through the admin console, never by bumping the seed
+    # a FRESH volume only. On a live volume a changed DICT_VERSION is ignored (the
+    # recorded .seed_version marker wins — the seed-drift guard), so a running contour's
+    # dictionary is changed through the admin console, not by bumping the seed
     # (docs/ARCHITECTURE.md §5).
     volumes:
       - dawg-data:/opt/dawg