Wave 36: /api/health HEAD support + deploy SHA

Fixed: HEAD /api/health was returning 405. Added: deploy.sha and deploy.env. /status.html shows live commit SHA.