chore(deps): Update docker Docker tag to v29

Reviewed-on: #100
Reviewed-by: Keith Jackson <[email protected]>

apps/wave-0/pihole.yaml

@@ -62,7 +62,7 @@ spec:
     spec:
       containers:
       - name: pihole
-        image: pihole/pihole:2026.10.0
+        image: pihole/pihole:2026.10.1
         ports:
         - containerPort: 80
         env:

apps/wave-1/gitea-actions.yaml

@@ -133,7 +133,7 @@ spec:
       initContainers:
         - name: dind
           restartPolicy: Always   # <- this field is what makes it a SIDECAR
-          image: docker:27-dind
+          image: docker:29-dind
           securityContext:
             privileged: true
           env:

apps/wave-1/sonarr.yaml

@@ -122,7 +122,7 @@ spec:
     spec:
       containers:
       - name: sonarr
-        image: lscr.io/linuxserver/sonarr:4.0.15
+        image: lscr.io/linuxserver/sonarr:4.0.20
         ports:
         - containerPort: 8989
         env:

catalog/pihole.yaml

@@ -5,7 +5,7 @@
 name: pihole
 kind: container
 source:
-  image: pihole/pihole:2026.10.0
+  image: pihole/pihole:2026.10.1
 exposure: internal            # LAN-only admin UI (docs/13 row 6; R-DNS/R-NET)
 egress: internet              # normal WAN egress (docs/03; R-NET-05)
 storage:

catalog/sonarr.yaml

@@ -8,7 +8,7 @@
 name: sonarr
 kind: container
 source:
-  image: lscr.io/linuxserver/sonarr:4.0.15   # pinned stable v4 tag (R-UPD-01); update.range governs advancement
+  image: lscr.io/linuxserver/sonarr:4.0.20   # pinned stable v4 tag (R-UPD-01); update.range governs advancement
 # LinuxServer images run their service as the user `abc`, whose uid/gid these two set. They are
 # LOAD-BEARING for the bulk mount, not cosmetic: see the storage note below. The default is 911,
 # which cannot write a 1000:3000-owned 0755 tree.

decisions/2026-10-31-pm-agent-digest-99.md

@@ -0,0 +1,41 @@
+---
+date: 2026-10-31
+branch: chore/pm-agent-digest-99
+title: Pin pm-agent dispatcher and worker to the agent-runner digest built from PR #99's merge
+---
+
+## What changed
+
+- `platform/pm-agent/deployment.yaml`: the dispatcher `image:` moves from
+  `agent-runner@sha256:df36d9b7…` (images run 383) to
+  `agent-runner@sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2`.
+  `config-generation` goes from "4" to "5" so the pod rolls.
+- `platform/pm-agent/configmap.yaml`: `PM_WORKER_IMAGE` gets the same digest. A comment line
+  records where it came from. The `# renovate-digest:` marker still sits directly above both
+  values.
+- No other values changed. `PM_DRY_RUN` stays "false". `PM_DECISION_MAX_TURNS` is not set, so
+  it keeps its in-code default of 1. No `*.sops.yaml` was touched.
+
+## What I verified
+
+- PR #99's merge commit is `466f63ec3c3df968a1dab25a8811dcd41961efde` (origin/main HEAD at
+  branch time).
+- The Gitea Actions tasks API shows the `images` workflow (images.yaml) on that commit as
+  **run 394** (task 643), with event `push` and status `success`.
+- I resolved the digest read-only from the registry by HEADing the manifests with OCI and
+  Docker Accept headers. Both `agent-runner:sha-466f63ec3c3d` and `agent-runner:main` returned
+  `200`, an `application/vnd.oci.image.manifest.v1+json` content type, and
+  `docker-content-digest: sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2`.
+  The two are identical.
+- Toolbox gate: the rc and skipped stages are in the PR description.
+
+## What I did NOT verify
+
+- That the dispatcher actually rolls to the new digest after merge, and that Flux applies it.
+  Flux's `lastAppliedRevision` and the pod's image were not checked. That is post-merge work.
+- That the new image surfaces the triage failure's real cause. It will show only on the next
+  failing triage, in the dispatcher log.
+- That admission (rule 7, `imagePullSecrets`) admits worker Jobs from this digest. The
+  template comes from `infra/agent/` at PR #99's merge, which still carries the
+  `imagePullSecrets` entry, but no Job was created to prove it.
+- I did not run the image's own selftest against this digest.

platform/buildkit/deployment.yaml

@@ -60,7 +60,7 @@ spec:
           # Pinned by digest (the multi-arch index). The kubernetes manager in renovate.json5
           # tracks platform/**, so Renovate proposes bumps; the CI client (buildx, pinned in
           # versions.env) talks to any recent daemon.
-          image: docker.io/moby/buildkit:v0.34.1-rootless@sha256:f68752a5a94acfcdad2d07867b7075601a421638e17fc5f28efc1c814d0c4f89
+          image: docker.io/moby/buildkit:v0.34.2-rootless@sha256:c8252268760e1baba80780d63d738ef9f260fb7c7c0973c78494cb9ddd99eda1
           args:
             - --addr
             - unix:///run/user/1000/buildkit/buildkitd.sock   # local only: the probes below

platform/intel-gpu-plugin/intel-gpu-plugin.yaml

@@ -63,7 +63,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: status.hostIP
-        image: intel/intel-gpu-plugin:0.37.0
+        image: intel/intel-gpu-plugin:0.37.1
         imagePullPolicy: IfNotPresent
         name: intel-gpu-plugin
         resources:

platform/intel-gpu-plugin/kustomization.yaml

@@ -96,4 +96,4 @@ images:
   - name: intel/intel-gpu-plugin
     newName: docker.io/intel/intel-gpu-plugin
     # renovate: datasource=github-releases depName=intel/intel-device-plugins-for-kubernetes
-    newTag: "0.37.0"
+    newTag: "0.37.1"

platform/kubevirt/kustomization.yaml

@@ -33,6 +33,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   # renovate: datasource=github-releases depName=kubevirt/kubevirt
-  - https://github.com/kubevirt/kubevirt/releases/download/v1.9.0/kubevirt-operator.yaml
+  - https://github.com/kubevirt/kubevirt/releases/download/v1.9.1/kubevirt-operator.yaml
   # renovate: datasource=github-releases depName=kubevirt/containerized-data-importer
-  - https://github.com/kubevirt/containerized-data-importer/releases/download/v1.66.0/cdi-operator.yaml
+  - https://github.com/kubevirt/containerized-data-importer/releases/download/v1.66.1/cdi-operator.yaml

platform/pm-agent/configmap.yaml

@@ -63,8 +63,11 @@ data:
   # agent-runner:sha-ddd04d460ef6, pinned in PR #96) bakes a template that carries
   # `imagePullSecrets: pm-agent-registry`, which is what made turning PM_DRY_RUN off possible
   # (decisions/2026-10-31-pm-agent-runner-digest.md). A digest older than that would be DENIED.
+  # The digest below (14a42ba, images run 394, agent-runner:sha-466f63ec3c3d = PR #99's merge)
+  # adds the CLI failure envelope to triage errors and the PM_DECISION_MAX_TURNS knob
+  # (decisions/2026-10-31-pm-agent-digest-99.md).
   # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
-  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d"
+  PM_WORKER_IMAGE: "gitea.home.keithjackson.dev/home-network/agent-runner@sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2"
 
   # --- the model -------------------------------------------------------------
   # The PM only reads a thread and answers with one JSON object, so it holds no tools and

platform/pm-agent/deployment.yaml

@@ -48,7 +48,7 @@ spec:
         # It is a hand-maintained marker rather than a computed hash because Flux's
         # Kustomization here does not run a configmap generator; bump it in the same commit
         # as a change to configmap.yaml.
-        pm-agent.homelab.keithjackson.dev/config-generation: "4"
+        pm-agent.homelab.keithjackson.dev/config-generation: "5"
     spec:
       serviceAccountName: pm-agent
       # The kubelet's credential for pulling this image. Not the agent's Gitea credential —
@@ -78,7 +78,7 @@ spec:
           # the registry's manifest endpoint on 2026-10-30 and pinned by hand once so the
           # dispatcher does not wait on Renovate's first run; every later bump is Renovate's.
           # renovate-digest: image=gitea.home.keithjackson.dev/home-network/agent-runner tag=main
-          image: gitea.home.keithjackson.dev/home-network/agent-runner@sha256:df36d9b7fef56d141220a387f64fb864cede8e5af30513ebfeb3ab566d3f771d
+          image: gitea.home.keithjackson.dev/home-network/agent-runner@sha256:14a42ba8281ecd98005f5d99ecda4fb729104c783b01584097c32e104ced1bb2
           imagePullPolicy: IfNotPresent
           command:
             - /usr/local/bin/pm-dispatch