Record what actually ran: commit SHA, script id, real tool versions

[rec3141]

Follow-on to #6, which added run_manifest.json. That manifest had three holes, all of
which made a real dataset untraceable.

What went wrong

A 363-sample dataset analysed 2026-07-23 could not say what produced it. Its report gave
microscape 1.0.0 — a manifest string unchanged across this repo's entire history — and
a null commit. The .sif that ran it had been overwritten two days later. Neither that
container's main.nf nor the current one matches any commit here. Three versions in
play, no way to tell them apart.

Three causes, three fixes

workflow.commitId is null for every run launched from the .sif, because there is
no git repo inside it — and that is how this pipeline actually runs. The Dockerfile now
takes GIT_SHA/GIT_REF/BUILD_DATE build args into env vars and OCI labels; CI already
knew the SHA (it tags the image with it) and now passes it in. The manifest falls back to
that and records which source the commit came from, so "unknown" is visible rather
than silent.

script_id (the MD5 of main.nf) is now recorded unconditionally. It pins the source
even when both of the above are missing, and it is the only reason this was diagnosable.

containers recorded image names, whose tags give versions only if tags are pinned.
It now also runs bin/tool_versions.sh, which asks each binary — cutadapt, mafft,
FastTree, DADA2, DECIPHER, ape, papa2, microscape, python, R, Nextflow. The env spec says
what was requested; only the binary knows what was resolved, and a claim resting on
DADA2's error model is not reproducible against "bioconductor-dada2".

Two things found while testing it in the real container

papa2 and microscape are pip install git+… and both report a hardcoded 0.1.0 that
has never changed — exactly the meaningless version this PR exists to remove. PEP 610
writes the real commit into direct_url.json, so the probe now records that too
(microscape 0.1.0 → d9b4645d3cd4). Companion PRs make the version strings themselves
meaningful: rec3141/microscape#1 (merged) and rec3141/papa2#1.

The container build only triggered on Dockerfile and envs/**, while
COPY . /pipeline/ puts main.nf, bin/ and nextflow.config inside the image. Editing
the pipeline shipped nothing — which is the mechanism behind the drift above. Build
triggers now cover what the image actually contains. Baking the SHA in is only meaningful
if the image rebuilds when the code changes.

Verified

bin/tool_versions.sh was run inside the actual .sif on fir, not just a dev machine.
Everything answers — cutadapt 5.2, mafft 7.526, FastTree 2.2.0, R 4.5.3, dada2 1.38.0,
DECIPHER 3.6.0, ape 5.8.1, python 3.13.14 — and the only two tools whose version string
means nothing are pinned by commit instead. That probe run also caught two bugs in it: a
shell "command not found" was being reported as "present but not answering", and
nextflow -v is not a flag. Both fixed; vsearch dropped, since it is a danaSeq tool and
appears nowhere in this pipeline.