ci(docker): pin base image on opencode's versioned nightly tag

`FROM jcabillot/opencode:latest` floats on the tag pushed by perso/opencode's
release workflow, which is never rebuilt afterwards: it is still the 2026-10-14
build while the nightly cron keeps rebuilding `vX.Y.Z-latest`. Renovate also
ignores `:latest` dependencies, so the base image could never be bumped.

Pin `v0.0.59-latest` (release v0.0.59 rebuilt nightly, latest rebuild
2026-10-17): fresh Debian/npm packages, explicit OpenCode version in the
Dockerfile, and Renovate can now follow the bumps.

The DL3007 hadolint ignore is dropped: that rule only fires on `:latest`.

.gitea/workflows/tag.yaml

@@ -38,33 +38,3 @@ jobs:
           pull: true
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
-  release:
-    # Publishes the Gitea release for this tag (body = commits since the previous
-    # tag). Renovate copies that body into the bump PR in
-    # perso_private/tf-depl-kubernetes under "Release Notes"; without a release
-    # that section stays empty (bare "Compare Source" link).
-    needs: [build-push]
-    uses: perso/gitea-pipelines/.gitea/workflows/gitea-release.yaml@main
-    with:
-      image: jcabillot/opencode-openchamber
-    secrets: inherit
-
-  trigger-renovate:
-    # The deployment repo perso_private/tf-depl-kubernetes pins this image; its
-    # Renovate instance only scans hourly, so this dispatch opens the image bump
-    # PR within minutes of the release instead of up to an hour later.
-    needs: [build-push, release]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Trigger Renovate on perso_private/tf-depl-kubernetes
-        # needs: build-push — Renovate reads Docker Hub, so a scan started before
-        # the push lands would only see the previous release.
-        # RENOVATE_TOKEN is the org-level secret of this organisation.
-        run: |
-          curl -sS -f -X POST \
-            -u "renovate:${{ secrets.RENOVATE_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            -d '{"ref":"main"}' \
-            "https://scm.cabillot.eu/api/v1/repos/perso_private/tf-depl-kubernetes/actions/workflows/renovate.yaml/dispatches"
-          echo "Renovate dispatched on perso_private/tf-depl-kubernetes"

Dockerfile

@@ -1,8 +1,8 @@
 # `vX.Y.Z-latest` = the vX.Y.Z release rebuilt nightly by perso/opencode's cron job
 # (fresh Debian/npm packages); the bare `latest` tag stays frozen at the last release.
-FROM jcabillot/opencode:v0.0.60-latest
+FROM jcabillot/opencode:v0.0.59-latest
 
-ARG OPENCHAMBER_WEB_VERSION=2.3.3
+ARG OPENCHAMBER_WEB_VERSION=2.3.2
 
 ENV NPM_CONFIG_UPDATE_NOTIFIER=false \
   NPM_CONFIG_LOGLEVEL=warn \