feat(fase-17): deploy script HEAD-tag check + tag column in deploy log

deploy-erosi.sh now runs `git describe --exact-match --tags HEAD` up
front. When HEAD is not at a tag, prints a yellow warning and sleeps
5s so the operator can Ctrl-C and tag before the rsync starts (no
abort — keeps untagged hotfix deploys possible). When a tag is
present, surfaces it in the banner next to the SHA.

`.deploys.log` gains a 4th tab-separated column: the tag (empty when
absent). The 3-column compat for pre-Fase-17 rows is preserved — the
rollback script's existing `cut -f1/-f2/-f3` keeps working, and `cut
-f4` returns the empty string for the older rows.

rollback-erosi.sh:
- `--list` reformats each row through awk so the tag is visible (with
  "(no tag)" placeholder for older rows), falling back to the raw log
  when awk isn't on PATH.
- The target banner shows `git tag: <tag>` when present.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

infra/scripts/rollback-erosi.sh

@@ -71,7 +71,19 @@ fi
 if [ "$MODE" = "list" ]; then
 	echo "Recent deploys ($DEPLOY_HOST):"
 	echo "------------------------------------------------------------"
-	printf '%s\n' "$log" | nl -ba
+	# Fase 17.3.3 — re-format each row so the tag (column 4, optional)
+	# is visible at a glance. Rows from before Fase 17 only have 3
+	# columns; the 4th `cut` returns empty and we substitute "(no tag)".
+	# Falls back to the raw log if awk isn't present (it always is on
+	# the deploy host, but we want the script to be robust on any
+	# operator laptop).
+	if command -v awk >/dev/null 2>&1; then
+		printf '%s\n' "$log" \
+			| awk -F '\t' '{ tag = ($4 == "" ? "(no tag)" : $4); printf "%s\t%s\t%s\t%s\n", $1, $2, tag, $3 }' \
+			| nl -ba
+	else
+		printf '%s\n' "$log" | nl -ba
+	fi
 	exit 0
 fi
 
@@ -91,10 +103,15 @@ fi
 target_ts=$(printf '%s' "$target_row" | cut -f1)
 target_sha=$(printf '%s' "$target_row" | cut -f2)
 target_backup=$(printf '%s' "$target_row" | cut -f3)
+# Fase 17.3.3 — 4th column is the tag (optional, empty on pre-Fase-17 rows).
+target_tag=$(printf '%s' "$target_row" | cut -f4)
 
 echo "==> Rollback target"
 echo "    timestamp: $target_ts"
 echo "    git sha:   $target_sha"
+if [ -n "${target_tag:-}" ]; then
+	echo "    git tag:   $target_tag"
+fi
 echo "    backup:    $target_backup"
 
 # ── 3. Verify SHA + backup ───────────────────────────────────────────────