REVERT both drill bumps: all four app pins back to their pre-drill images

Restores templates/{vikunja,uptime-kuma,wishlist,glance}/docker-compose.yml to exactly
their content at ff9717d379 — verified byte-identical for every image line.

catalog_since is 2026-09-21 on all four rather than the older pre-drill dates: the
catalog-since gate requires an image move to carry the day's date in EITHER direction,
and a revert is a move. The bump and its revert net to zero.

This clears the vikunja alpine:3.20 negative-control edge, which a background security
review correctly flagged as a supply-chain change. It was deliberate, it is the
documented C3-class control, no customer or demo box runs vikunja, and a deployed app
is frozen at its own pin since v0.235.0 — but the window is now closed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/glance/docker-compose.yml

@@ -8,7 +8,7 @@
 
 services:
   glance:
-    image: glanceapp/glance:v0.8.6
+    image: glanceapp/glance:v0.8.5
     container_name: glance
     restart: unless-stopped
     environment:

templates/uptime-kuma/docker-compose.yml

@@ -8,7 +8,7 @@
 
 services:
   uptime-kuma:
-    image: louislam/uptime-kuma:2.5.1
+    image: louislam/uptime-kuma:2.4.0
     container_name: uptime-kuma
     restart: unless-stopped
     environment:

templates/vikunja/docker-compose.yml

@@ -9,7 +9,7 @@
 
 services:
   vikunja:
-    image: alpine:3.20
+    image: vikunja/vikunja:2.3.0
     container_name: vikunja
     user: "0:0"
     restart: unless-stopped

templates/wishlist/docker-compose.yml

@@ -8,7 +8,7 @@
 
 services:
   wishlist:
-    image: ghcr.io/cmintey/wishlist:v0.67.0
+    image: ghcr.io/cmintey/wishlist:v0.66.0
     container_name: wishlist
     restart: unless-stopped
     environment: