ci(fxhnt): deploy step — keep scale 0->1 dance + deployed-sha annotation

Verified live: fxhnt-dashboard has its own dedicated tailscale sidecar
(TS_HOSTNAME=fxhnt-dashboard) and there is no Ingress/Gateway/VirtualService
in ns foxhunt routing dashboard.fxhnt.ai anywhere. fxhnt-ingress is an
unrelated nginx+tailscale pod (its own Deployment/Service, own tailscale
identity) for git/ssh routes, not the dashboard. The tailscale-session race
on `rollout restart` is real, so keep scale 0->1. Added the
fxhnt.io/deployed-sha annotation on both fxhnt-dashboard and dagster before
the rollouts, per the CI/CD plan Task 2.

infra/argo/fxhnt-cockpit-workflowtemplate.yaml

@@ -118,6 +118,8 @@ spec:
             kubectl apply -f infra/k8s/services/fxhnt-dashboard.yaml
             kubectl apply -f infra/k8s/orchestration/dagster.yaml
             kubectl apply -f infra/k8s/network-policies/fxhnt-cockpit.yaml
+            kubectl -n foxhunt annotate deploy/fxhnt-dashboard deploy/dagster \
+              fxhnt.io/deployed-sha="$(cd /workspace/src && git rev-parse --short HEAD)" --overwrite
             # Dashboard: scale 0 -> 1, NOT `rollout restart`. Its tailscale sidecar serves dashboard.fxhnt.ai;
             # a rolling restart briefly overlaps two tailscale sessions on the same identity -> session race ->
             # the external proxy link goes stale and the cockpit reads "down" post-deploy. Scaling to 0 cleanly