fix(inventory): bake the variant a pin forces, as the round's include already does

services_overrides_for_round applied the # variant-pin: markers when it resolved a round's include set, while plan_dev_inventory_matrix built round_variants, which the inventory bake, the deploy CLI and the swarm matrix read, by clamping the round index alone. Once docs variant 0 pinned web-app-dashboard#reciprocal, round 2 of a sweep resolved dashboard variant 1 (SSO off, no web-app-keycloak in the inventory) but baked variant 0 (SSO on): Keycloak came up without its own bake, defaulted totp_enabled to true, and every dashboard login stopped at CONFIGURE_TOTP while the Keycloak card was missing (11 jobs of run 40042690056).

active_variants_for_round holds the clamp-plus-pins logic once; services_overrides_for_round and the planner both call it, and the planner keeps the primary apps' indices on top.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/python/cli/administration/deploy/development/inventory/test_planner.py

@@ -255,5 +255,44 @@ class TestFilterPlanToVariants(unittest.TestCase):
             filter_plan_to_variants(self.PLAN, [0, 7])
 
 
+class TestPlanBakesPinnedVariant(unittest.TestCase):
+    @patch(
+        "utils.roles.applications.variants.resolve_pins",
+        autospec=True,
+        return_value={"web-app-bar": 1},
+    )
+    @patch(
+        "cli.administration.deploy.development.inventory.legacy_resolver._resolve_round_include",
+        autospec=True,
+        return_value=("web-app-bar", "web-app-foo"),
+    )
+    @patch(
+        "cli.administration.deploy.development.inventory.legacy_resolver._build_services_overrides_for_round",
+        autospec=True,
+        return_value={},
+    )
+    @patch(
+        "cli.administration.deploy.development.inventory.planner.get_variants",
+        autospec=True,
+    )
+    def test_round_variants_carry_the_pinned_index(
+        self,
+        get_variants_mock: MagicMock,
+        _overrides_mock: MagicMock,
+        _include_mock: MagicMock,
+        _pins_mock: MagicMock,
+    ) -> None:
+        get_variants_mock.return_value = {
+            "web-app-foo": [{}],
+            "web-app-bar": [{}, {}],
+        }
+        plan = plan_dev_inventory_matrix(
+            roles_dir="/roles",
+            primary_apps=["web-app-foo"],
+            base_inventory_dir="/srv/inv",
+        )
+        self.assertEqual(plan[0][2], {"web-app-foo": 0, "web-app-bar": 1})
+
+
 if __name__ == "__main__":  # pragma: no cover
     unittest.main()