feat(engine,deploy): seed-drift guard + track current dictionary release

The dictionary release moved to v1.2.1 while DICT_VERSION stayed pinned at
v1.0.0 in CI and the image/compose seed defaults. Two problems:

1. CI validated against a stale dictionary.
2. The contour seed could be bumped on a live volume, which silently relabels
   the already-seeded bytes — voiding games pinned to the prior label and
   serving the wrong dictionary for new ones. The flat DAWGs carry no embedded
   version, so this drift was undetectable.

Changes:

- Seed-drift guard: OpenWithVersions records the flat dir's version in a
  .seed_version marker on first boot and refuses to start when a later
  BACKEND_DICT_VERSION disagrees. DICT_VERSION is now the seed for a *fresh*
  volume only; a live contour migrates through the admin console (old versions
  stay resident, in-progress games keep replaying).
- Track the current release: CI's DICT_VERSION centralised to one workflow-level
  env (v1.2.1); image/compose/.env seed defaults bumped to v1.2.1. The deploy
  job keeps reading the per-contour vars.TEST_DICT_VERSION.
- Docs: ARCHITECTURE §5 (decision record), backend/deploy READMEs, PRERELEASE
  tracker (DV row).

Verified locally against the v1.2.1 artifact: gofmt, build, vet, unit and
integration (-tags=integration) all green.

backend/internal/engine/registry.go

@@ -71,13 +71,21 @@ func Open(dir, version string, variants ...Variant) (*Registry, error) {
 // version V, the variants whose committed DAWG it carries. This is the
 // restart-side of the admin dictionary reload — a version reloaded into dir/<V>/
 // at runtime is resident again after a restart. A subdirectory named like the
-// boot version is skipped (the flat dir already is the boot version). A partially
-// loaded registry is closed before any error is returned.
+// boot version is skipped (the flat dir already is the boot version). It records
+// and enforces a seed-version marker on the flat dir (see checkSeedMarker), failing
+// when the build seed was bumped on an already-seeded volume. A partially loaded
+// registry is closed before any error is returned.
 func OpenWithVersions(dir, bootVersion string) (*Registry, error) {
 	r, err := Open(dir, bootVersion)
 	if err != nil {
 		return nil, err
 	}
+	// Guard the seed-drift footgun before scanning for additional versions: refuse
+	// to boot when the flat dir was seeded under a different version than bootVersion.
+	if err := checkSeedMarker(dir, bootVersion); err != nil {
+		_ = r.Close()
+		return nil, err
+	}
 	entries, err := os.ReadDir(dir)
 	if err != nil {
 		_ = r.Close()