[lukepolo]

Every Monday, the pinned third-party images move to their newest releases: minor and patch releases go into one PR that merges itself once its checks pass, and each major release opens its own PR, assigned to me for a compatibility check.

• .github/scripts/image_updates.sh finds every image: and *_IMAGE= pin with a version tag and keeps the tag's shape: the v, the number of version parts and the suffix (-alpine, -pg18, -k3s1) stay, so prereleases and other builds never match. A pinned digest is re-pinned to the new tag's.
• A release is major when the first version part changes, or below 1.0 the second.
• A major PR lists what to check and the branch/... channel its branch release is published to. Closing it skips that release; a newer major opens a new PR and closes the old one. If main moves the pin under an open major PR, the PR is rebuilt.
• cert-manager (held on 1.17), the system-upgrade-controller's vendored files, and the TimescaleDB upgrade-test fixtures only move by hand.
• Branches and PRs come from the 5Stack Ops app, so they start the checks and the branch release. The app needs Contents: read & write and Pull requests: read & write on this repo first.
• image_updates_test.sh runs with the panel scripts.
• Tested from this PR before the trigger was removed: it opened chore: hasura/graphql-engine v2.51.4-ce.cli-migrations-v3, python 3.15.2-alpine3.24, rancher/k3s v1.37.2-k3s1 and rustfs/rc v0.1.37 #730 with four bumps, waited on its checks, and left it open and assigned when the gateway tests failed on k3s 1.37. feature: images update themselves, Traefik binds the host's ports so backends see real client addresses, and on k3s 1.37 the Gateway API CRDs are left to k3s #731 fixes that failure.

[lukepolo]

Folded into #731, which carries these commits with the k3s Gateway API change so they merge together.