Merge remote-tracking branch 'origin/main' into feature/sys-ctl-hlth-runtime/vulnerable-runtimes/1127

roles/svc-ai-ollama/meta/services.yml

@@ -13,7 +13,7 @@ ollama:
   backup:
     no_stop_required: true
   image: ollama/ollama
-  version: 0.40.12
+  version: 0.40.13
   name: ollama
   min_storage: 3473MB
   cpus: "4.0"

roles/web-app-bluesky/meta/services.yml

@@ -62,7 +62,7 @@ web:
 view:
   enabled: false
   repository: https://github.com/bluesky-social/social-app.git
-  ref: "1.136.0"
+  ref: "1.137.0"
   ports:
     local:
       http: 8051

roles/web-app-fusiondirectory/TODO.md

@@ -1,4 +1,4 @@
 # To-dos
 
 - Move off PHP 7.4. The pinned `nfrastack/fusiondirectory:1.5` image builds on `ghcr.io/nfrastack/container-nginx-php-fpm` with PHP 7.4 on Alpine 3.15, which is end of life and gets no fix for CVE-2026-109618 and CVE-2026-109619.
-- Mount the shared PHP hardening ini (`FILE_PHP_HARDENING_INI`) once the image's scan dir is verified. The nfrastack init scripts manage `conf.d` at runtime, so a read-only mount there has to be tested before it ships.
+  - No FusionDirectory release runs on a supported PHP yet: upstream certifies 1.4 to 1.6 for PHP 7.4 only, `nfrastack/container-fusiondirectory` builds its image only on PHP 7.4 and Alpine 3.15, and the PHP 8 port lives on upstream's unreleased `php8` branch. Until then the shared hardening ini mounted at `/etc/php7/conf.d/zz-infinito-hardening.ini` carries the mitigations for both CVEs. Options: rebuild the image on upstream's first `php8` release, or build `nfrastack/container-fusiondirectory` against a pinned `php8` commit on `container-nginx-php-fpm` 8.4 before that release.

roles/web-app-fusiondirectory/meta/volumes.yml

@@ -1,4 +1,11 @@
 ---
+php_hardening:
+  type: config
+  source: "{{ FILE_PHP_HARDENING_INI }}"
+  mode: "0444"
+  mounts:
+    - service: fusiondirectory
+      target: /etc/php7/conf.d/zz-infinito-hardening.ini
 # nocheck: embedded-state-on-nfs generated asset cache; the authoritative state lives in LDAP
 data:
   type: volume