Show the command a build actually runs on its artifact page

The artifact page read `branches.<branch>.buildCommand` from the primary
config only, so for a named build on a branch with its own config it showed
a command that build never ran — on vm4006 it showed the host config's
command for a build that ran the branch definition's `pitestFull`.

Resolving "what does this build run" now has one implementation,
`GitTallyConfig.buildSettings(branch, build)`: the branch entry with the
build definition's overrides applied last. The executor uses it, and the
page resolves it against the branch layer committed at the build's own
commit — the same inputs the executor had.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/test/kotlin/de/hoennig/gittally/server/PermanentBranchRoutesTest.kt

@@ -8,6 +8,7 @@ import de.hoennig.gittally.build.BuildResultRepository
 import de.hoennig.gittally.build.BuildStatus
 import de.hoennig.gittally.config.ConfigLoader
 import de.hoennig.gittally.config.GitTallyConfig
+import de.hoennig.gittally.git.GitService
 import de.hoennig.gittally.metrics.SystemMetricsCollector
 import io.kotest.core.spec.style.FunSpec
 import io.mockk.clearMocks
@@ -52,6 +53,9 @@ class PermanentBranchRoutesTest : FunSpec() {
     @MockkBean
     lateinit var configLoader: ConfigLoader
 
+    @MockkBean
+    lateinit var gitService: GitService
+
     @MockkBean
     lateinit var metricsCollector: SystemMetricsCollector
 
@@ -81,11 +85,14 @@ class PermanentBranchRoutesTest : FunSpec() {
                 artifactStore,
                 controlTokens,
                 configLoader,
+                gitService,
                 metricsCollector,
                 branchListing,
                 branchPermalinks,
             )
             every { configLoader.load(any()) } returns GitTallyConfig()
+            every { configLoader.loadWithBranchLayer(any(), anyNullable()) } returns GitTallyConfig()
+            every { gitService.showFileAtCommit(any(), any(), any()) } returns null
             every { controlTokens.token() } returns "test-token"
             every { branchListing.branches(any()) } returns emptyList()
             every { branchPermalinks.latestGreenBuild("main") } returns greenBuild