Harden public delivery, probes, and asset caching

[azurras]

Summary

• serve canonical robots and sitemap metadata with explicit no-cache behavior
• expose public liveness/readiness groups while keeping detailed health private
• version rendered static-resource URLs and apply immutable caching only to release-scoped assets
• validate both public hosts and the expanded route/probe matrix during switch and rollback
• derive the runtime release identity from the deployed commit and document the production contract

Verification

• gradlew.bat clean build — passed (21 tasks)
• focused PublicDeliveryConfigurationTest — 6/6 passed
• Invoke-Pester -Path .\ops\production\windows\tests — 239 passed, 0 failed, 4 environment-only skips
• isolated port-8091 runtime route/header matrix — passed; production port 8080 remained healthy
• git diff --check — clean

Closes #1122
Closes #1123
Closes #1124
Closes #1138