feat(discourse): pin the application version where the updater can see it

params.version sat commented out in app.yml, so Discourse silently inherited
tests-passed and every bootstrap could pull a different application revision
with nothing recording which.

Declaring it as services.discourse.version would have been invisible to both
updaters: utils/update/docker.py reaches version: only through
iter_role_images, which skips any service without an image: (discovery.py,
"if not image or not version: continue"), and Discourse is built by the
launcher and has none. A nested application entry carrying repository: and
ref: lands in utils/update/repository.py instead, whose walk_repo_ref_pairs
descends the whole tree; the collector now reports

  discourse/application | discourse.git | v2026.8.0

so git ls-remote --tags keeps the pin current rather than freezing it, and the
external URL test sees the repository through iter_non_ignored_files. This is
the shape 7b15c61dfc established when it migrated version/branch keys to ref.

v2026.8.0 is the newest stable tag: v2026.9.0 answers 404, only
v2026.9.0-latest exists. The auto-bump will not drift onto those pointers,
version_flavor("v2026.8.0") is empty and latest_semver with that flavor picks
the plain tag back.

Pinning the core while the plugins clone from their default branch is safe
because upstream solves it: docker_manager, discourse-akismet and
discourse-activity-pub each ship a .discourse-compatibility map, and the
bootstrap checks out the plugin commit matching an older core. The newest
threshold in those maps is 2026.4.0-latest, below this pin, so the default
branch is the intended pairing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-discourse/meta/services.yml

@@ -69,6 +69,9 @@ discourse:
   ref: main
   min_storage: 15GB
   repository: https://github.com/discourse/discourse_docker.git
+  application:
+    repository: https://github.com/discourse/discourse.git
+    ref: v2026.8.0
   plugins:
     docker_manager:
       enabled: true

roles/web-app-discourse/templates/config.yml.j2

@@ -29,7 +29,7 @@ params:
   #db_work_mem: "40MB"
 
   ## Which Git revision should this container use? (default: tests-passed)
-  #version: tests-passed
+  version: {{ DISCOURSE_VERSION }}
 
 env:
   LC_ALL:   "{{ DISCOURSE_LOCAL }}"

roles/web-app-discourse/vars/main.yml

@@ -17,6 +17,7 @@ DISCOURSE_REDIS_PORT: "{{ lookup('engine', 'redis', application_id, 'port') }}"
 DISCOURSE_REDIS_PASSWORD: "{{ lookup('engine', 'redis', application_id, 'password') }}"
 DISCOURSE_REPOSITORY_URL: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.repository') }}"
 DISCOURSE_REF: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.ref') }}"
+DISCOURSE_VERSION: "{{ lookup('config', application_id, 'services.' ~ entity_name ~ '.application.ref') }}"
 DISCOURSE_LDAP_AUTH_PLUGIN_REPOSITORY: "{{ lookup('config', application_id, 'addons.discourse-ldap-auth.config.repository') }}"
 DISCOURSE_LDAP_AUTH_PLUGIN_REF: "{{ lookup('config', application_id, 'addons.discourse-ldap-auth.config.ref') }}"