feat(vision): il worker che espone il runner, versione stampata al build

Container FastAPI separato (Dockerfile.vision, python:3.13-slim) che
espone run_graph/engine_version del Task 2 via POST /run e GET /health,
cosi' l'immagine del server principale non importa mai VisionSuite.

engine_version() ora legge VISION_ENGINE_VERSION se impostata, altrimenti
ricade su git rev-parse nel checkout di sviluppo, e non inventa mai un
valore: senza nessuna delle due solleva un errore esplicito. Nel container
il fallback a git non puo' funzionare (.git del submodule punta fuori dal
build context), quindi Dockerfile.vision prende il commit come build arg
e lo fissa in ambiente; i compose file lo passano da VISION_ENGINE_VERSION.

Nessuna porta pubblicata e nessuna label Traefik sul servizio vision: e'
raggiungibile solo dal server, su tmflow-net.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014BBnuACZSCJqXrMYC3LUMU

src/vision/tests/test_runner.py

@@ -18,6 +18,7 @@ pytest.importorskip(
 
 import numpy as np
 
+from src.vision import runner
 from src.vision.runner import RunOutcome, engine_version, run_graph
 
 
@@ -74,3 +75,36 @@ def test_a_broken_tool_does_not_sink_the_others():
 def test_the_engine_says_which_version_it_is():
     version = engine_version()
     assert len(version) == 40  # a full git SHA
+
+
+def test_engine_version_honours_the_environment_variable(monkeypatch):
+    """A build-stamped VISION_ENGINE_VERSION wins over git, if set (Ruling R8:
+    the container has no usable .git for the vendored submodule, so the
+    worker image stamps the commit at build time instead of discovering it)."""
+    stamped = "a" * 40
+    monkeypatch.setenv("VISION_ENGINE_VERSION", stamped)
+    runner._engine_version_from_git.cache_clear()
+
+    try:
+        assert engine_version() == stamped
+    finally:
+        runner._engine_version_from_git.cache_clear()
+
+
+def test_engine_version_raises_rather_than_inventing_one(monkeypatch):
+    """No env var and no resolvable git HEAD: refuse loudly. An engine that
+    cannot say what it is has no business producing measurements - it must
+    never fall back to a guess, an empty string, or "unknown"."""
+    monkeypatch.delenv("VISION_ENGINE_VERSION", raising=False)
+    runner._engine_version_from_git.cache_clear()
+
+    def fake_check_output(*args, **kwargs):
+        raise FileNotFoundError("git: command not found")
+
+    monkeypatch.setattr(runner.subprocess, "check_output", fake_check_output)
+
+    try:
+        with pytest.raises(RuntimeError, match="VISION_ENGINE_VERSION"):
+            engine_version()
+    finally:
+        runner._engine_version_from_git.cache_clear()