Sentry release tracking for production (git sha + deploy markers) #1240

Describe the current behavior
Every event in the kaapi-production Sentry project reports release 0.5.0. The release id comes from the hand-maintained API_VERSION setting, so it has not changed since April 2026. The release has no commits and no deploys attached, which means:

• "Regressed in release" and "Resolved in next release" do not work.
• Suspect commits are never shown on an issue.
• There is no way to tell from Sentry which production deploy introduced a problem.

Describe the enhancement you'd like

• Code (shared with staging): build the release id from Docker build args as kaapi-backend@<RELEASE_TAG or API_VERSION>+<git sha 12>. SENTRY_RELEASE stays as an override. GIT_SHA already exists in settings; add RELEASE_TAG.
• backend/Dockerfile: accept a RELEASE_TAG build arg.
• .github/workflows/create-release.yml (tag push → ECS production):
  • checkout with fetch-depth: 0
  • resolve the same release id (kaapi-backend@${GITHUB_REF_NAME}+${GITHUB_SHA::12})
  • pass --build-arg RELEASE_TAG=${{ github.ref_name }}
  • after both ECS rollouts succeed, register the release and deploy with getsentry/action-release (environment: production, set_commits: auto)
• GitHub setup: Sentry organization token (project:releases, org:read) as the SENTRY_AUTH_TOKEN secret, plus SENTRY_ORG and SENTRY_PROJECT (kaapi-production) variables. Without them the new step fails the deploy job.

Draft implementation and runbook: #1234 (docs/runbooks/sentry-release-tracking.md).

Why is this enhancement needed?
Faster triage after a production deploy: issues link to the commit and deploy that introduced them, and regressions are flagged automatically.

Additional context

• Staging is tracked separately; it deploys through a different workflow.
• Verify after the first tag deploy: Sentry → Releases shows the new id under production with a non-zero commit count, and API and Celery report the same release.