v0.152.0 + felhom-samba 1.1.0 — mDNS for macOS, and the card stops offering a dead form

Capture on the box disproved the first theory: macOS DOES send a correct NBNS
query for <NAME><20> and nmbd DOES answer it correctly in 140us (flags 0x8580,
RCODE=0, right address) - macOS just never acts on it. NetBIOS there feeds
legacy browsing, not smb:// URL resolution, so the bare name can never work on
a Mac and nmbd was never the broken part.

felhom-samba 1.1.0 adds avahi + dbus, with avahi-daemon.conf and the _smb._tcp
service file templated from FELHOM_SERVER_NAME so a rename re-advertises. Both
daemons are non-fatal on failure - a discovery gap must not become an outage.

v0.151.0's card offered smb://<NAME> for Mac, which is exactly the dead form;
now smb://<NAME>.local. Windows keeps the flat \\<NAME>, which nmbd serves
correctly. Red-proofed both directions.

NOT claimed: Finder-sidebar discovery - published and answering on the wire,
but not observed working on the test Mac. Recorded OPEN.

TestRenderSambaCompose pinned the literal 1.0.0 tag, so an image bump read as a
renderer regression; now derives from SambaImage and asserts non-:latest.

controller/internal/infra/infra.go

@@ -27,7 +27,7 @@ const (
 	FileBrowserImage = "gtstef/filebrowser:1.3.3-stable"
 	// SambaImage is our own pinned LAN-sharing image (R-7 slice 1). Built by
 	// controller/scripts/build-samba-image.sh from controller/infra-images/samba/. NEVER :latest.
-	SambaImage = "gitea.dooplex.hu/admin/felhom-samba:1.0.0"
+	SambaImage = "gitea.dooplex.hu/admin/felhom-samba:1.1.0"
 )
 
 // Images returns every controller-managed infra image, derived from the pins above so there is

controller/internal/infra/samba_test.go

@@ -77,7 +77,7 @@ func TestRenderSambaCompose(t *testing.T) {
 	got := RenderSambaCompose(sampleSambaData())
 	for _, want := range []string{
 		"network_mode: host",
-		"image: gitea.dooplex.hu/admin/felhom-samba:1.0.0",
+		"image: " + SambaImage,
 		"- ./smb.conf:/etc/samba/smb.conf:ro",
 		"- samba-passdb:/var/lib/samba",
 		"FELHOM_SERVER_NAME=FELHOM",
@@ -87,6 +87,13 @@ func TestRenderSambaCompose(t *testing.T) {
 			t.Errorf("compose missing %q\n%s", want, got)
 		}
 	}
+	// The tag must be EXPLICIT — a floating :latest breaks reproducible pins and is the thing the
+	// constant exists to prevent. Asserted on the constant's shape, so an image bump is a one-line
+	// change in infra.go and never a test edit.
+	if strings.HasSuffix(SambaImage, ":latest") || !strings.Contains(SambaImage, ":") {
+		t.Errorf("SambaImage %q must carry an explicit non-latest tag", SambaImage)
+	}
+
 	// Read-only share → :ro bind (red-proof target: drop the :ro in the renderer and this fails).
 	roBind := "- /mnt/felhom-drives/media/filmek:/mnt/felhom-drives/media/filmek:ro"
 	if !strings.Contains(got, roBind) {