deploy: pin m12-poisonfix-20260831 (both incident defects fixed)

Digest 93a2929d, commit 44820d4. Live on all three pods after a staged 2->1->0
roll with a POST /items quorum probe between stages (201 each).

The roll needed ZERO manual pod restarts — the previous one needed three because
two reseed markers latched per node and only one discharged. Pods came Ready in
30s / 80s / 110s.

Verified against the exact probe that caused the outage: 128-dim vector into the
1536-dim content_vector slot now returns 400 with a specific message instead of
500, no receiver halted on any pod, all 9 shard frontiers at lag 0, reseed_gaps
empty, writes 201. Playwright 34/34, semantics 5/5, verify-live 23/23.

k8s/cluster/statefulset.yaml

@@ -100,7 +100,7 @@ spec:
               mountPath: /data
       containers:
         - name: tidaldb
-          image: registry.threesix.ai/tidal/server:m12-harden-20260831@sha256:accdbad48814919fe9cece14738a904df755f3e7937e1f1d0df07cc9cd5cb9d2
+          image: registry.threesix.ai/tidal/server:m12-poisonfix-20260831@sha256:93a2929d2473c753ed2322aac547dcc5a2d8598fd00aada5104553d7b8632078
           imagePullPolicy: IfNotPresent
           # The image ENTRYPOINT is the bare binary. We override the command with
           # a tiny /bin/sh wrapper (the bookworm-slim runtime HAS a shell) so we