golden 0.298.0 baked (pinned Docker set; the first unpinned bake replaced before any vouch); golden gate test on the gate's UTC clock; bake runbook names GOLDEN_DOCKER_PKGS

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/RUNBOOK-manual-build.md

@@ -170,6 +170,7 @@ qemu-system-x86_64 -enable-kvm -cpu host -smp 4 -m 8192 \
    cat > /root/bake-run.sh <<'EOS'
    #!/bin/bash
    GT=$(cat /root/.gitea-token)
+   export GOLDEN_DOCKER_PKGS="<the approved Docker set: all six pkg=version pairs>"
    export GITEA_USER=admin GITEA_TOKEN="$GT" REGISTRY_USER=admin REGISTRY_TOKEN="$GT"
    exec /root/build-golden.sh 9100 local:vztmpl/<template> local-lvm local vmbr0 \
      gitea.dooplex.hu/admin/felhom-controller:<VER>
@@ -178,6 +179,11 @@ qemu-system-x86_64 -enable-kvm -cpu host -smp 4 -m 8192 \
    systemd-run --unit=golden-bake --collect bash -c "/root/bake-run.sh > /root/bake.log 2>&1"
    ```
 
+   **`GOLDEN_DOCKER_PKGS` is not optional.** Without it the script installs the NEWEST stable Docker, not the approved
+   one, and says so only as a `WARNING` line in `bake.log` (2026-10-06, the 0.298.0 bake: missed, re-baked). Copy the
+   six pairs from the previous bake's `Docker engine set PINNED to the approved release:` line, or from the hub's newest
+   approved Docker release (System page). Pass marker: that `PINNED` line, and no `GOLDEN_DOCKER_PKGS not set`.
+
    Confirm the value went nowhere: `systemctl show golden-bake -p Environment -p ExecStart |
    grep -c -F "$(cat /root/.gitea-token)"` must be `0`. Copy the token in **file → file** (`scp`), so
    it never crosses a shell on either side.