Log build revision at startup in both binaries

The burn-in pairs a coordinator with a worker, and step one of every run is
checking that both report the burn-in commit. That was only visible behind the
operator login, at /v1/admin/diagnostics and /v1/federation/workers, and the
worker never logged its own revision at all. Both now print it on startup, so
`docker logs orchestra-api` and `journalctl -u orchestra-worker` are enough.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/orchestra-worker/main.go

@@ -1462,6 +1462,11 @@ func main() {
 		if err := w.api.Register(context.Background(), w.registration); err != nil {
 			log.Fatalf("register %s: %v", spec.ID, err)
 		}
+		// Same reason as the coordinator's: the worker half of the pair must be
+		// checkable from journalctl, not only from the coordinator's
+		// credentialed worker list.
+		b := buildinfo.Current()
+		log.Printf("orchestra-worker revision %s built %s dirty %s", b.Revision, b.Time, b.Dirty)
 		log.Printf("serving harness %s (%s) on %s backend, state %s", spec.ID, spec.Harness, w.backend.Kind(), w.statePath)
 		workers = append(workers, w)
 	}

cmd/orchestra/main.go

@@ -1661,6 +1661,12 @@ func main() {
 	if port == "" {
 		port = "9145"
 	}
+	// Deployed identity, without a credential. A burn-in run pairs a
+	// coordinator and a worker, and matching revisions must be evidence rather
+	// than assumption. /v1/admin/diagnostics carries the same object behind
+	// the operator login.
+	b := buildinfo.Current()
+	log.Printf("orchestra revision %s built %s dirty %s", b.Revision, b.Time, b.Dirty)
 	log.Println("orchestra listening on :" + port)
 	tokens := map[authz.Surface]string{
 		authz.TUI: os.Getenv("ORCHESTRA_TUI_TOKEN"),