fix: export IMAGE_TAG in the remote deploy script -- guard could never pass

.github/workflows/deploy.yml

@@ -368,7 +368,15 @@ jobs:
             "$SSH_USER@$SSH_HOST" "$REMOTE_CMD" <<'REMOTE_SCRIPT'
           set -euo pipefail
           DEPLOY_PATH="$1"
-          IMAGE_TAG="$2"
+          # Exported, not a plain assignment: `docker compose config --images` below
+          # runs as a separate child process, and a compose file's `${IMAGE_TAG:-...}`
+          # interpolation only sees variables that are actually in that process's
+          # environment. A plain (non-exported) IMAGE_TAG here would make every
+          # `docker compose` invocation silently fall back to the compose file's
+          # default (`<env>-latest`) instead of the immutable tag — the guard below
+          # would then never match, and if it were ever bypassed, an actual deploy
+          # would pull/run the wrong, mutable image instead of the pinned commit.
+          export IMAGE_TAG="$2"
           # $3 is relative (see the env comment above) — resolved against $HOME here,
           # on the host itself, rather than ever hardcoding an absolute /home/<user>
           # path in the workflow source. Needed as an absolute path below: `docker