fix(go): exclude /api/version from parity diff — identity, not contract

/api/version returns each binary's own tag/commit/build_date, which
differs by design between independently built backends. Diffing it
always produces a false positive. Drop it from allRoutes; the route
remains reachable via `make parity ARGS="-route /api/version"`.

Also remove the vestigial `build_meta` allowlist entry (Python returns
the build dict as the top-level response body, not nested under
build_meta, so the scrubber never matched anything).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

go/cmd/parity/main.go

@@ -14,13 +14,17 @@ import (
 	"github.com/google/go-cmp/cmp/cmpopts"
 )
 
-var allRoutes = []string{"/api/version", "/api/adults", "/api/juniors", "/api/payments"}
+// /api/version is intentionally excluded — it returns each binary's own build
+// identity (tag/commit/build_date), which differs by design between independently
+// built backends. Pass -route /api/version to inspect it manually.
+var allRoutes = []string{"/api/adults", "/api/juniors", "/api/payments"}
 
 // defaultAllowlist holds dotted key paths to strip before diffing.
-// These fields are expected to differ between backends (e.g. build tags, timing)
-// or may appear on one side only. Today both are absent from the JSON — this is
-// forward-compatible insurance for if either is added later.
-var defaultAllowlist = []string{"render_time.total", "build_meta"}
+// render_time.total is forward-compatible insurance: today it lives in the Jinja
+// template context only (app.py inject_render_time) and is logged via
+// middleware/timer.go on the Go side, so it isn't in any JSON response. If either
+// side ever surfaces it under a render_time envelope, the scrubber handles it.
+var defaultAllowlist = []string{"render_time.total"}
 
 func main() {
 	pyURL := flag.String("py", "http://localhost:5001", "Python backend base URL")