M8/D7: bridge reflects final pass/fail onto the PR comment + content-hash image tag

After triggering a build, the bridge spawns a watcher thread that polls the Drone build to
completion and edits its run-link PR comment to ✅ passed / ❌ <status> (Gitea PATCH
issues/comments/{id}, verified). post_comment now returns the comment id. Also gives the bridge
image a content-hash tag so the swarm service actually rolls on bridge.py changes (was stuck on
:latest). Completes the D7 'PR comment reflects outcome' requirement.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

modules/bridge.nix

@@ -10,9 +10,14 @@ let
     cp ${../bridge/bridge.py} $out/app/bridge.py
   '';
 
+  # Content-derived tag so `docker stack deploy` rolls the service whenever bridge.py changes
+  # (a fixed `:latest` + unchanged stack spec does NOT roll — swarm sees no change).
+  imageTag = builtins.substring 0 12 (builtins.hashString "sha256"
+    (builtins.readFile ../bridge/bridge.py));
+
   image = pkgs.dockerTools.buildLayeredImage {
     name = "cc-ci-bridge";
-    tag = "latest";
+    tag = imageTag;
     contents = [ pkgs.python3 pkgs.cacert bridgeApp ];
     config = {
       Cmd = [ "${pkgs.python3}/bin/python3" "/app/bridge.py" ];
@@ -25,7 +30,7 @@ let
     version: "3.8"
     services:
       app:
-        image: cc-ci-bridge:latest
+        image: cc-ci-bridge:${imageTag}
         environment:
           - GITEA_API=https://git.autonomic.zone/api/v1
           - DRONE_URL=https://drone.ci.commoninternet.net