feat: expose build identity for release verification

internal/transport/httpserver/server.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"time"
 
+	"git.yuntuo.hk/k2safe/orbit/internal/buildinfo"
 	"git.yuntuo.hk/k2safe/orbit/internal/observability"
 	"git.yuntuo.hk/k2safe/orbit/pulse/service"
 )
@@ -32,6 +33,13 @@ func New(addr string, ready Checker, tasks ...*service.Service) *http.Server {
 		}
 		write(w, http.StatusOK, map[string]string{"status": "ready", "scope": "database_and_schema"})
 	})
+	mux.HandleFunc("GET /version", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_ = json.NewEncoder(w).Encode(buildinfo.Current())
+	})
 	if len(tasks) > 0 && tasks[0] != nil {
 		registerTasks(mux, tasks[0])
 		registerHistory(mux, tasks[0])