image pinning: eliminate :latest from all 5 unpinned templates + standing gate

bentopdf :latest -> v2.8.6; calibre-web :latest -> v4.0.6 (== running digest on
demo 9201, c31a738b - pin is a no-op); papra :latest -> 26.6.1-rootless (latest
was the rootless variant); recipe-importer :latest -> v0.9.11 (tag pre-existed,
digest-equal, no retag needed); termix :latest -> 2.5.0.

All five pins digest-identical to what :latest resolved to on 2026-07-12.
New gate scripts/check-image-pins.py (catches floating tags AND untagged refs;
red-proofed both shapes). Standing rule in CLAUDE.md + REUSE.md row.

templates/bentopdf/docker-compose.yml

@@ -8,7 +8,7 @@
 
 services:
   bentopdf:
-    image: ghcr.io/alam00000/bentopdf:latest
+    image: ghcr.io/alam00000/bentopdf:v2.8.6
     container_name: bentopdf
     restart: unless-stopped
     environment:

templates/calibre-web/docker-compose.yml

@@ -18,7 +18,7 @@
 
 services:
   calibre-web:
-    image: crocodilestick/calibre-web-automated:latest
+    image: crocodilestick/calibre-web-automated:v4.0.6
     container_name: calibre-web
     restart: unless-stopped
     environment:

templates/papra/docker-compose.yml

@@ -8,7 +8,7 @@
 
 services:
   papra:
-    image: ghcr.io/papra-hq/papra:latest
+    image: ghcr.io/papra-hq/papra:26.6.1-rootless
     container_name: papra
     restart: unless-stopped
     environment:

templates/recipe-importer/docker-compose.yml

@@ -12,7 +12,7 @@
 
 services:
   recipe-importer:
-    image: gitea.dooplex.hu/admin/recipe-importer:latest
+    image: gitea.dooplex.hu/admin/recipe-importer:v0.9.11
     container_name: recipe-importer
     restart: unless-stopped
     environment:

templates/termix/docker-compose.yml

@@ -8,7 +8,7 @@
 
 services:
   termix:
-    image: ghcr.io/lukegus/termix:latest
+    image: ghcr.io/lukegus/termix:2.5.0
     container_name: termix
     restart: unless-stopped
     environment: