Merge branch 'main' into feature/store-i18n

Eight conflicts, none resolved by taking a side wholesale.

compose_file_args.py: main's removal of the dead templar parameter kept, its _value_has_domain/_has_domain helpers dropped. They served only the inlined CA check that the ca_injected lookup replaces, and the call site already carried main's signature.

web-app-penpot/01_administrator.yml: main's side. PR #1170 moves the admin password from the environment and sh -lc into stdin, and the test_quote_in_shell lint it ships enforces that.

web-app-mattermost/meta/services.yml: this side. The source build exists so the image is multi-arch; main's bump to mattermost/mattermost-team-edition:12.0.1 would drop that silently. The version lag is a follow-up.

web-app-bigbluebutton: main's b83b361ea9 runs BBB v3.0.39, where upstream replaced etherpad with bbb-shared-notes-server, so the ep_redis_publisher patch, the postgres entrypoint and the initdb hook go with their files. html5_settings and its render task stay: git log -S shows main carries no commit for them, they came from 76e9441117 on this side. vars/main.yml takes main's BBB_PINNED_SERVICES with this side's entity_name filter, because get_entity_name no longer exists here. The README keeps this side's feature bullets with main's etherpad-free wording; main's Cosmos section is dropped, the branch does not carry that section.

tests/integration/iam/passwords/test_quote_in_shell.py: this side's STDIN_BLOCK_RE, which the merged file uses at line 116.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/plugins/lookup/test_compose_file_args.py

@@ -1,5 +1,7 @@
 import importlib.util
+import tempfile
 import unittest
+from pathlib import Path
 from unittest.mock import patch
 
 from ansible.errors import AnsibleError
@@ -206,6 +208,16 @@ class TestComposeFArgs(unittest.TestCase):
 
         self.assertEqual(out, "-f /x/compose.yml")
 
+    def test_role_provides_override_reads_the_role_of_the_given_application(self):
+        with (
+            tempfile.TemporaryDirectory() as role,
+            patch.object(self.m, "abs_role_path_by_application_id", return_value=role),
+        ):
+            self.assertFalse(self.m._role_provides_override(application_id="x"))
+            (Path(role) / "templates").mkdir()
+            (Path(role) / "templates" / "compose.override.yml.j2").write_text("")
+            self.assertTrue(self.m._role_provides_override(application_id="x"))
+
     def test_requires_one_term(self):
         with self.assertRaises(AnsibleError):
             self.lookup.run([], variables=self.vars)