The reconcile agent on the host reads this file from origin/master to decide
which image to run, so deploying and rolling back are both git operations and
no CI job ever needs a network path to the host.
The SHA is the current master revision. The agent will not act on it until an
image tagged with that SHA exists in the Gitea registry, so recording it now is
safe.
