fix(deploy): pin web image tag correctly in k8s and helm

dc3/deploy/helm/dc3/README.md

@@ -40,7 +40,7 @@ helm upgrade --install dc3 . -f values-production.yaml   --set image.registry=my
 
 | Value | Default | Meaning |
 |-------|---------|---------|
-| `image.registry` / `image.tag` | `pnoker` / `2026.6` | image source for every component |
+| `image.registry` / `image.tag` | `pnoker` / `2026.6` | image source for every component (`services.web.tag` overrides: web has no series tag) |
 | `secrets.*` | weak public defaults | **replace before production** |
 | `existingSecret` | `""` | use your own Secret instead of the chart-owned one |
 | `services.<name>.replicas` | per service | replica count per stateless service |

dc3/deploy/helm/dc3/templates/app-deployment.yaml

@@ -32,7 +32,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: dc3-{{ $name }}
-          image: "{{ $.Values.image.registry }}/{{ $svc.image }}:{{ $.Values.image.tag }}"
+          image: "{{ $.Values.image.registry }}/{{ $svc.image }}:{{ $svc.tag | default $.Values.image.tag }}"
           imagePullPolicy: {{ $.Values.image.pullPolicy }}
 {{- if $svc.envFrom }}
           envFrom:

dc3/deploy/helm/dc3/values.yaml

@@ -102,6 +102,10 @@ services:
   web:
     enabled: true
     image: dc3-web
+    # dc3-web is published only as `latest` and full release versions (e.g.
+    # 2026.6.0) - it has NO series tag, so it overrides the global image.tag.
+    # Pin a full release version for reproducible production rollouts.
+    tag: latest
     replicas: 1
     envFrom: false
     httpPort: 80

dc3/deploy/k8s/kustomization.yaml

@@ -74,8 +74,11 @@ secretGenerator:
 
 # Single place to bump/switch the image tag or registry for every component.
 images:
+  # dc3-web is published only as `latest` and full release versions (e.g.
+  # 2026.6.0) - it has NO series tag. Pin a full release version here for
+  # reproducible production rollouts.
   - name: pnoker/dc3-web
-    newTag: 2026.6
+    newTag: latest
   - name: pnoker/dc3-gateway
     newTag: 2026.6
   - name: pnoker/dc3-center-auth

dc3/deploy/k8s/web/deployment.yaml

@@ -24,7 +24,8 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: dc3-web
-          image: pnoker/dc3-web:2026.6
+          # dc3-web has no series tag - latest or a full release version only
+          image: pnoker/dc3-web:latest
           imagePullPolicy: IfNotPresent
           env:
             - name: APP_API_HOST