kimai: database engine mariadb 11.6 -> 11.8, its own edge (proven on the bench AND on 9202)

The engine alone moves (R-450: an engine change gets its own edge). Asked of
the engine, not the log: "already upgraded to 11.8.9-MariaDB" after
MARIADB_AUTO_UPGRADE's mariadb-upgrade ran (Phase 1/8 on the box). Bench:
the seeded user read back; memory: kimai 6 % own (cgroup 100 %, cache),
kimai-db 37.9 %; 0 kills; abort starts-and-serves. Box (9202): done, read
back, R-626 clean. 09 decision 21.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/kimai/.felhom.yml

@@ -10,7 +10,7 @@ subdomain: "time"
 slug: "kimai"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-07-18"
+catalog_since: "2026-09-23"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -113,3 +113,9 @@ i18n:
       - env_var: ADMIN_PASSWORD
         label: 'Admin password'
         description: 'For the first sign-in. You can change it in the app afterwards.'
+
+# update_ladder — the test record: one tested step per line, oldest first (JSON flow mappings,
+# `09-update-architecture.md` §6.4 part 4). WRITTEN BY scripts/upgrade-test.py, never by hand;
+# gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
+update_ladder:
+  - {"from": {"kimai": "kimai/kimai2:apache-2.57.0", "kimai-db": "mariadb:11.6"}, "to": {"kimai": "kimai/kimai2:apache-2.57.0", "kimai-db": "mariadb:11.8"}, "digest": {"kimai": "sha256:efa66c5eadf948b94d8031e9436feae491d90b2ceaa3d5e45e4d7c1a59dd8c38", "kimai-db": "sha256:79d59758afc91b89b120b0a8904d637f5a3b3e1c4900f29b740d6d46c72fef68"}, "verdict": "proven", "tested_at": "2026-09-23T19:58:59Z", "harness_version": 3, "evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/kimai/bench/evidence/MV-kimai/verdict.json", "box_evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/kimai/verdict.json", "memory_peak_pct": 37.9, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 100.0}

templates/kimai/docker-compose.yml

@@ -46,7 +46,7 @@ services:
       - "traefik.http.services.kimai.loadbalancer.server.port=8001"
 
   kimai-db:
-    image: mariadb:11.6
+    image: mariadb:11.8
     container_name: kimai-db
     restart: unless-stopped
     environment: