`FROM jcabillot/opencode:latest` floats on the tag pushed by perso/opencode's
release workflow, which is never rebuilt afterwards: it is still the 2026-10-14
build while the nightly cron keeps rebuilding `vX.Y.Z-latest`. Renovate also
ignores `:latest` dependencies, so the base image could never be bumped.
Pin `v0.0.60-latest` (released from perso/opencode main, rebuilt nightly by
cron.yaml): fresh Debian/npm packages, explicit OpenCode version in the
Dockerfile, and Renovate can now follow the bumps.
The DL3007 hadolint ignore is dropped: that rule only fires on `:latest`.