heal.sh now:
1. git fetch + reset --hard origin/main when remote is ahead
2. writes web/data/deploy.json (sha + timestamp) after each pull
3. nginx reload if web/ files changed
4. falls back to writing deploy.json on first run if missing
spec/index.html shows deployed commit SHA + timestamp in footer.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
