docs(routes): point the /healthz header at CARGO_PKG_VERSION, not a literal

[argszero]

Summary

The src/routes/mod.rs module header documented the /healthz response as
{"status":"ok","version":"0.2.0"}, while the handler in the same file
returns env!("CARGO_PKG_VERSION") (today 0.7.28). 0.2.0 was the correct
version on the day the line was written (91aaba09, 2026-08-18) and it has been
stale for the 26 releases since.

This one-liner replaces the hardcoded snapshot with a pointer to the mechanism
(<CARGO_PKG_VERSION>), so it cannot drift again. The repository already states
the "never hardcode the version" rule in three other carriers — src/routes/ops.rs,
ui/js/app.js, and ui/README.md — all of which name CARGO_PKG_VERSION as the
one source shared with /healthz.

Comment-only change: no production logic is touched.

Related Issue

(none — found while reviewing the module headers for claim drift)

Changes

• src/routes/mod.rs: the /healthz doc line now reads
  {"status":"ok","version":"<CARGO_PKG_VERSION>"} with a short pointer to
  env!("CARGO_PKG_VERSION")
• No config / data-structure changes

Tests

• cargo test — 426 passed; 0 failed (baseline unchanged)
• cargo fmt --check — clean
• cargo clippy --all-targets -- -D warnings — clean
• No new unit test added (this is a documentation line; the behaviour is
  already pinned by routes::tests::healthz_ok, which asserts
  v["version"] == env!("CARGO_PKG_VERSION"))

Checklist

• Branch named per convention (docs/…)
• Commit message uses Conventional Commits (docs(routes): …)
• Single responsibility, minimal change (1 file, +1/−1)

[argszero]

Self-review (committer, allow_self_merge). One-line, comment-only change; no
production logic. Verified locally in the session clone:

• cargo test — 426 passed / 0 failed (baseline unchanged)
• cargo fmt --check — clean
• cargo clippy --all-targets -- -D warnings — clean
• The response shape stays documented: only the stale 0.2.0 snapshot becomes a
  pointer at CARGO_PKG_VERSION, the source the code (healthz()) and the three
  policy carriers (routes/ops.rs, ui/js/app.js, ui/README.md) already share.

LGTM.