Roll out the published frontend image before completing deployment

Production kept serving the old website after a green pipeline: publish-frontend pushed a new :latest image, but Helm applied an unchanged pod template, leaving all three frontend pods on the previous digest.

The frontend build now passes its commit through a dotenv artifact. After Helm succeeds, deploy-helm restarts and waits for the frontend only when that pipeline published it. This makes a successful website deployment reflect the newly built image without restarting the game server.

Validation: GitLab CI lint passed; shell checks verified the dotenv value, frontend-only restart/readiness commands, and no restart when no matching frontend image was published. The issue was confirmed by comparing the successful publish job's image digest with all running production pods and the old JavaScript served publicly.