Restore 'shipped' on the home page, /updates and chat deploy notices: since the release layout (C-76) the release worktree is root-owned, so git refused the service user ('dubious ownership') and all three read nothing; their read-only git calls now pass -c safe.directory=*

ddiff --git a/server/chat/deploy-notice.js b/server/chat/deploy-notice.js
iindex 4e220659..38e6f56b 100644
---- a/server/chat/deploy-notice.js
++++ b/server/chat/deploy-notice.js
@@@ -37,7 +37,8 @@ const REPLAY_MS = 15 * 60 * 1000;
  let _live = null;   // { payload, until, sent: WeakSet }
  
  const git = (args, timeout = 5000) => new Promise((resolve) => {
--    execFile('git', args, { cwd: REPO_DIR, encoding: 'utf8', timeout, maxBuffer: 1024 * 1024 }, (err, out) => resolve(err ? '' : String(out || '')));
++    // -c safe.directory=*: the release layout's worktrees are root-owned and the service user only reads them.
++    execFile('git', ['-c', 'safe.directory=*', ...args], { cwd: REPO_DIR, encoding: 'utf8', timeout, maxBuffer: 1024 * 1024 }, (err, out) => resolve(err ? '' : String(out || '')));
  });
  
  const parseLog = (raw) => raw.trim().split('\n').filter(Boolean).map((line) => {
ddiff --git a/server/home/routes.js b/server/home/routes.js
iindex b4b9f619..5af6d415 100644
---- a/server/home/routes.js
++++ b/server/home/routes.js
@@@ -413,7 +413,8 @@ function _refreshLatestUpdate() {
      if (_updateCache.running) return;
      _updateCache.running = true;
      require('child_process').execFile(
--        'git', ['--no-pager', 'log', '--pretty=format:%h||%s||%aI', '-1'],
++        // -c safe.directory=*: the release layout's worktrees are root-owned; the service user only reads them.
++        'git', ['-c', 'safe.directory=*', '--no-pager', 'log', '--pretty=format:%h||%s||%aI', '-1'],
          { cwd: require('path').join(__dirname, '../..'), encoding: 'utf8', timeout: 4000 },
          (err, stdout) => {
              _updateCache.running = false;
ddiff --git a/server/index.js b/server/index.js
iindex 069274cb..6aaaf695 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -815,7 +815,8 @@ function readCommits(limit) {
      // Coalesce: a burst of first-loads after a deploy must not spawn a git process each.
      if (_updatesCache.inflight) return _updatesCache.inflight;
      _updatesCache.inflight = new Promise((resolve) => {
--        execFile('git', ['--no-pager', 'log', '--pretty=format:%H||%h||%s||%an||%aI', `-${limit}`],
++        // -c safe.directory=*: the release layout's worktrees are root-owned; the service user only reads them.
++        execFile('git', ['-c', 'safe.directory=*', '--no-pager', 'log', '--pretty=format:%H||%h||%s||%an||%aI', `-${limit}`],
              { cwd: REPO_DIR, encoding: 'utf8', timeout: 5000, maxBuffer: 1024 * 1024 },
              (err, stdout) => {
                  _updatesCache.inflight = null;