Issue #239 opened: diagnose_app: cross-check latest deployment status vs running container

Split from #237 (item 4).

Motivation

An app can be running:healthy while its most recent deployment is failed — old container serving, new code never arrived. diagnose_app currently reports healthy in that state.

Proposal

diagnose_app already fans out; add a check comparing the latest deployment's status against the running state:

• If latest deployment failed/cancelled while app is running, flag explicitly: "running container predates the last (failed) deployment — the app is serving stale code".
• Include the failed deployment's UUID and a next-action hint (deployment get with lines).

Acceptance

• Diagnosis output includes a deployment-freshness finding with an explicit stale-code warning when the latest deployment failed.
• Test covering the running-but-last-deploy-failed state.