probe fix, the gate, and the promotion train (R-618 closed, R-630..632 opened)

Part 1: tandoor/zipline/wger probes corrected in the catalog and red-proofed live on 9202 in both
directions - "Nem egeszseges" with the front door serving 200, then "Fut" after the real sync with
no redeploy. tandoor's failed edge re-walked: done at +41.1s where it was failed at +361.9s.

Part 2: fifteen proven versions on the live catalog, one commit per app; the guarded Update pressed
on four apps on demo-hp, all four done.

Opened: R-630 (paperless-ngx's probe has never run on any box - a silent absence, worse than the
wrong probe that was found in one night), R-631 (five templates no static rule can judge),
R-632 (28 of 53 templates never deployed by any drill). Closed: R-618.

Register 318 -> 321. No product code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -1095,6 +1095,21 @@ Version strings stay in the logs, the API and the hub.
    name a probe the app does not answer**, so a SUCCESSFUL update of those apps ends by STOPPING
    a working app (**R-618**, P1 — tandoor measured serving HTTP 200 on the new version at four
    samples across five minutes, then stopped).
+   **CLOSED 2026-09-22, and the closing changed the numbers above:** the three probes were
+   corrected (`app-catalog-felhom.eu@793c4fb`), red-proofed live on 9202 in both directions, and a
+   static gate now refuses a probe that does not match the same service's own compose healthcheck.
+   **tandoor's edge was re-walked with nothing else changed and ended `done` at +41.1 s** where it
+   had ended `failed` at +361.9 s — so the tally is **15 proven, 2 failed, 4 inconclusive**, and all
+   fifteen are on the live catalog since 2026-09-22.
+   **WHAT THE CLOSING FOUND, and it is the part worth carrying forward:** a wrong probe was the
+   LOUD failure. Two quiet ones sit beside it. `paperless-ngx` has no container whose name matches
+   its stack name, so `findProbeContainer` returns nothing and **its probe has never run on any box**
+   — an absence, with no badge to contradict it (**R-630**). And five more templates cannot be judged
+   statically at all, one of which (`home-assistant`) is correct only because its check type cannot
+   fail (**R-631**). **So "the probe is right" is now enforced for 47 of 53 templates and still
+   unknown for six.**
+   **AND THE SWEEP'S REAL CEILING, counted rather than felt: 28 of the 53 templates have never been
+   deployed by any drill** (**R-632**) — the widening above went from 3 apps to 21, and 21 is not 53.
 9. **The hub does not record image tags at all.** Its report's container payload carries name, state,
    CPU and memory, and no image field (spike §5). So the fleet view of §6 slice 7 needs a hub-side
    change; it is not derivable from what is already reported.