Require MCP_GRAFANA_VERSION build-arg; fix workflow step order and comments

Dockerfile

@@ -19,14 +19,14 @@
 # this image — the token comes from the server's own Kubernetes secret
 # (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.
 
-ARG MCP_GRAFANA_VERSION=v1.1.0
+ARG MCP_GRAFANA_VERSION
 
 FROM docker.io/library/alpine:3.22 AS fetch
 
 ARG MCP_GRAFANA_VERSION
 ARG TARGETARCH
 
-# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
+# curl + tar + coreutils (sha256sum) to fetch and verify the pinned
 # upstream release. ca-certificates for HTTPS to github.com — and the CA
 # bundle is copied into the final scratch image too, because Grafana
 # (GF_SERVER_ENFORCE_DOMAIN=true) redirects API calls to its canonical
@@ -41,6 +41,7 @@ WORKDIR /tmp
 # .sbom.json sidecar entries for the same tarball names, which must stay out
 # of the sha256sum input (only the downloaded tarball is verified).
 RUN set -eux; \
+    [ -n "${MCP_GRAFANA_VERSION:-}" ] || { echo "MCP_GRAFANA_VERSION build-arg is required"; exit 1; }; \
     SHORT="${MCP_GRAFANA_VERSION#v}"; \
     case "$TARGETARCH" in \
         amd64) ASSET="Linux_x86_64" ;; \