feat(services): give fifteen moving pins a name the registry can order

A pin like 'alpine', 'stable', 'lts' or 'buildx-stable-1' names no version,
so nothing can compare it to anything: the bump job skips it and the pin
drifts with whatever upstream last pushed under that name. Each of these
fifteen now names its release, which is the precondition for the freshness
pipeline to see it at all.

Every conversion was placed against the tag it replaces, and none of them
is a downgrade. Six resolve to a byte-identical digest and are pure
relabelling (memcached, redis, the two debian bases, jenkins, xwiki); four
are genuinely newer than what the moving tag carried, so those roles will
deploy a later version than before (nginx moves past the 1.31.5 behind
'alpine', buildkit past the v0.32.2 behind 'buildx-stable-1', dockerize
past a 'latest' older than v0.10.0); openresty and pretix keep their
version and differ only by build.

fider is the one that loses something: 'stable' carries a rebuild pushed
twelve days after v0.36.0, which is still the newest versioned tag
upstream publishes. An unnamed rebuild cannot be tracked, so the pin takes
the named release and the updater can raise it when v0.37.0 lands.

The flavor invariant keeps the families apart: jenkins stays on '-lts' and
xwiki inside '-postgres-tomcat', so no bump can cross into a different
runtime.

svc-runner loses a 'nocheck: docker-version' that has become dead. The
marker suppresses two checks at once, so while it stood buildkit was held
out of the daily freshness warning as well; removing it puts the role back
in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/svc-db-memcached/meta/services.yml

@@ -11,7 +11,7 @@ memcached:
   enabled: true
   shared: true
   image: memcached
-  version: alpine
+  version: 1.6.45-alpine
   name: memcached
   min_storage: 206MB
   backup:

roles/svc-db-openldap/meta/services.yml

@@ -12,7 +12,7 @@ openldap:
   shared: true
   provides: ldap
   image: debian
-  version: bookworm-slim
+  version: 12.15-slim
   custom: true
   name: openldap
   min_storage: 229MB

roles/svc-db-redis/meta/services.yml

@@ -12,7 +12,7 @@ redis:
   shared: true
   image: redis
   name: redis-central
-  version: alpine
+  version: 8.10.1-alpine
   min_storage: 238MB
   backup:
     disabled: true

roles/svc-net-tor/meta/services.yml

@@ -20,7 +20,7 @@ tor: # nocheck: category-modes
   exclusive: true
   primary: true
   image: debian
-  version: trixie-slim
+  version: 13.6-slim
   custom: true
   name: tor
   node: ""

roles/svc-prx-openresty/meta/services.yml

@@ -31,7 +31,7 @@ openresty:
   mem_reservation: 1g
   mem_limit: 2g
   image: openresty/openresty
-  version: alpine
+  version: 1.31.1.1-alpine
   custom: true
   lifecycle: beta
   pids_limit: 256

roles/svc-runner/meta/services.yml

@@ -30,8 +30,7 @@ buildkit:
   enabled: false
   shared: false
   image: moby/buildkit
-  # nocheck: docker-version
-  version: "buildx-stable-1"
+  version: "v0.33.0"
 # nocheck: dynamic-flag
 act-runner:
   enabled: false

roles/web-app-bigbluebutton/meta/services.yml

@@ -195,7 +195,7 @@ bbb-webrtc-recorder:
 # nocheck: dynamic-flag: fixed upstream-compose helper, not group-gated
 dockerize:
   image: jwilder/dockerize
-  version: "latest"
+  version: "v0.11.0"
   enabled: false
 
 # nocheck: playwright-service-flag, dynamic-flag infrastructure backup consumer

roles/web-app-fediwall/meta/services.yml

@@ -52,7 +52,7 @@ fediwall:
     swarm:
       enabled: true
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   custom: true
   upstream:
     version: "1.4.0"

roles/web-app-fider/meta/services.yml

@@ -36,7 +36,7 @@ fider:
     swarm:
       enabled: true
   image: getfider/fider
-  version: stable
+  version: v0.36.0
   name: fider
   min_storage: 400MB
   backup:

roles/web-app-jenkins/meta/services.yml

@@ -46,7 +46,7 @@ jenkins:
   # nocheck: single-replica
   replicas: 1
   image: jenkins/jenkins
-  version: lts
+  version: 2.568.3-lts
   custom: true
   name: jenkins
   ports:

roles/web-app-littlejs/meta/services.yml

@@ -38,7 +38,7 @@ littlejs:
   repository: https://github.com/KilledByAPixel/LittleJS.git
   ref: main
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   custom: true
   ports:
     local:

roles/web-app-pretix/meta/services.yml

@@ -53,7 +53,7 @@ pretix:
     swarm:
       enabled: true
   image: pretix/standalone
-  version: stable
+  version: 2026.7.0
   custom: true
   name: pretix
   min_storage: 1003MB

roles/web-app-taiga/meta/services.yml

@@ -92,7 +92,7 @@ gateway:
     internal:
       http: 80
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   cpus: "0.3"
   mem_reservation: 256m
   mem_limit: 512m

roles/web-app-xwiki/meta/services.yml

@@ -56,7 +56,7 @@ xwiki:
   enabled: true # nocheck: dynamic-flag
   shared: true
   image: xwiki
-  version: lts-postgres-tomcat
+  version: 17.10.13-postgres-tomcat
   custom: true
   name: xwiki
   min_storage: 965MB

roles/web-svc-coturn/meta/services.yml

@@ -31,7 +31,7 @@ coturn:
   lifecycle: beta
 gateway:
   image: nginx
-  version: alpine
+  version: 1.31.6-alpine
   cpus: "0.3"
   mem_reservation: 256m
   mem_limit: 512m