catalog_since on all 53 apps: the date this repo last moved each app's pinned images

Backfilled from this repo's own git history (newest commit whose image: set differs
from its parent's), excluding the two bentopdf SPIKE commits by hash — they moved a
pin and reverted it in the same hour and are a measurement, not a release.

Four anchors confirmed (nextcloud 5e2c1ae, grafana b789acc, calcom 147cee7,
vikunja 3fa63cd, all 2026-07-18); six apps re-checked against git log by hand.

Consumed by felhom-controller v0.233.0 to render 'Frissitesi elerheto - N napja'.
No version number is ever shown to the customer, so there is no version: key.

Rule added to CLAUDE.md; the missing drift gate is filed as a register row (the
gates runner fetches at --depth 1 and has no parent to diff an image: line against).

CHANGELOG.md

@@ -1,3 +1,36 @@
+## catalog_since on all 53 apps — how long has a newer pin been sitting here? (2026-09-02, update arc slice 2)
+
+**One new optional key in every `.felhom.yml`, no compose file changed, no image moved.**
+
+`catalog_since: "YYYY-MM-DD"` records the date THIS repo last changed that app's pinned images. The
+controller (v0.233.0) compares what a box is ACTUALLY running against what the template now pins and
+renders one Hungarian badge — *"Naprakész"* or *"Frissítés elérhető — 45 napja"*. **No version number
+is shown to the customer anywhere** (operator ruling, 2026-09-02: a household cannot act on
+`26.05.2`), so there is deliberately no `version:` key to keep in sync alongside this one.
+
+**Backfilled from this repo's own git history**, not typed by hand: for each app, the newest commit
+whose set of `image:` values differs from its parent's. Four anchors confirmed against the spike's
+own numbers — nextcloud `5e2c1ae`, grafana `b789acc`, calcom `147cee7`, vikunja `3fa63cd`, all
+2026-07-18 — and six apps re-checked against `git log` by hand (bentopdf, plex, crafty-controller,
+homebox, bookstack, wanderer).
+
+**Two commits were EXCLUDED BY HASH and the reason is the point:** `214d448` and `30bd892`, the
+bentopdf pin move and its same-hour revert, are recorded above as a spike MEASUREMENT and not a
+release. Counting them would have dated bentopdf 2026-09-02 for a pin that has not actually moved
+since `71828a8` (2026-07-12), which is when `:latest` became `v2.8.6`.
+
+Range: 2026-02-15 (plex, still on its original pin) to 2026-07-21. Thirty-eight of the 53 sit on
+2026-07-18, the catalog-wide bump.
+
+**The rule this creates, now in `CLAUDE.md`:** any commit that changes an `image:` line must set that
+app's `catalog_since` to the same day. **There is no gate enforcing it yet** — the gates runner
+fetches at `--depth 1` and has no parent commit to diff against — and that gap is filed as a register
+row rather than left implicit.
+
+Gates after the change: `image-pins` **OK**. `image-resolvable` and `volume-persistence` came back
+INCONCLUSIVE for environmental reasons unrelated to this change (Docker Hub throttled 6 of 65
+unauthenticated manifest lookups; the volume prober's own canary needs a scratch Docker host).
+
 ## SPIKE measurement — bentopdf pin moved and reverted the same hour (2026-09-01, R-438) — NOT A RELEASE
 
 **No template is different after this pair of commits.** `214d448` moved