fix(action): build payload with jq and document that swarm mode deploys the tag

Interpolating inputs straight into the JSON string let a quote in image or
tag break the payload. Also replaces GNU-only head -n -1 so the action runs
on BSD/macOS runners.

CLAUDE.md

@@ -73,6 +73,10 @@ curl -sH "Authorization: Bearer $UPDATER_API_KEY" \
   with a permission error against a worker-only node. This is an operator/deployment
   concern (point `DOCKER_HOST` at a manager, or schedule the updater on a manager),
   not something the code can detect or work around.
+- **`tag` is cosmetic in compose mode but load-bearing in swarm mode.** `handlers.go` folds it
+  into the requested image; compose discovery strips it via `NormaliseImage`, but
+  `SwarmExecutor` assigns it directly to `ContainerSpec.Image`. A request without a tag updates
+  a Swarm service to `:latest`.
 
 ## References