feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them

pihole/pihole (no tag)               -> 2026.10.0               sha256:d3413471...
lscr.io/linuxserver/jackett:latest   -> v0.24.2865-ls7          sha256:4fcf3cc2...
plexinc/pms-docker:latest            -> 1.43.4.10903-e5521bd8c  sha256:e0ab2739...

Each tag was resolved against its registry and matched the pods' imageID, so the image is
unchanged (the pod template string does change, so Flux rolls the three workloads).

renovate.json5: regex versioning for jackett (-lsN) and plex (build-hex); jackett is looked
up on ghcr.io via overridePackageName, because lscr.io is capped at dockerMaxPages=20 pages
and jackett's 32k tags put the running one at #31,980 (dry run proposed nothing without it);
jackett weekly (13 builds in 12 days); pihole deliberately unheld, year rollover = major.
Stale "publishes only latest" prose fixed in renovate.json5 and three runbooks.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

runbooks/plex-quicksync.md

@@ -371,8 +371,8 @@ verify".)
    2026-10-01, so this means a node changed — a rebuild, a BIOS reset, or a driver regression.
    **Fix the node.**
 
-4. **The image changed under you.** See "The floating-image caveat". A `:latest` pull can remove the
-   mechanism this feature leans on with no commit in this repo.
+4. **The image changed under you.** See "The image-version caveat". A pms-docker version bump (a
+   Renovate PR, possibly auto-merged) can remove the mechanism this feature leans on.
 
 5. **The session was never transcoding.** Direct Play / Direct Stream never reaches the transcoder,
    so no `hardware transcoding:` line is written for it at all. An *absent* line is this, not a
@@ -446,17 +446,21 @@ revert you):
 Re-adding the field later is the same edit in reverse. Nothing about the Plex-side toggle or the
 `/config` PVC is affected either way — do **not** delete the PVC as part of this.
 
-## The floating-image caveat
+## The image-version caveat
 
 Everything this page states about the image's behaviour — the `cont-init.d` hook that adds the app
 user to the device's group, the absence of `PLEX_PREFERENCE*`, the six `setPref` keys, the
 `HardwareAcceleratedCodecs` string — was read from digest **`sha256:e0ab27395614…`**
 (`plexmediaserver 1.43.4.10903`).
 
-The deployment runs **`plexinc/pms-docker:latest` with `imagePullPolicy: Always`**. A silent pull can
-therefore change the behaviour this feature depends on **with no commit in this repo**, while the
-manifest still looks identical. Symptom to watch for: hardware transcoding that worked and quietly
-stopped, with no git change to point at.
+**Since 2026-10-30 that digest is pinned:** `catalog/plex.yaml` names
+`plexinc/pms-docker:1.43.4.10903-e5521bd8c`, which resolved to exactly `sha256:e0ab27395614…` on
+Docker Hub. Before that the deployment ran the floating `:latest` (implicitly `imagePullPolicy:
+Always`), and a silent pull could change this behaviour with no commit in the repo. That is no longer
+the failure mode: the image now changes only through a **Renovate PR** bumping that tag (patch/minor
+ones auto-merge on a green gate, and the gate does not exercise QuickSync). So the symptom to watch
+for is hardware transcoding that quietly stopped **after a `chore(deps)` pms-docker bump** — check
+`git log -- catalog/plex.yaml` first.
 
 ```
 infra/devcontainer/dev.sh run bash -c \