Upgrade Discourse to latest version

Tracks thunderbird/platform-infrastructure#1080.

Current pinned image: v0.1.2 (668807881758.dkr.ecr.eu-central-1.amazonaws.com/discourse), referenced in three places: argocd/workloads/discourse-web.yaml, argocd/workloads/discourse-sidekiq.yaml, argocd/workloads/discourse-migrate-job.yaml.

Background

container/containers/app.yml in this repo does not set a version: override, so it inherits discourse_docker's default (templates/web.template.yml: version: latest) — every build already checks out the tip of discourse/discourse's default branch. So there is no Discourse version string to bump here. "Upgrade" means: cut a fresh build to pick up whatever changed upstream since v0.1.2, verify it, and roll it out.

Steps

1. Check compatibility of the bundled/cloned plugins against current upstream discourse/discourse:
   • Bundled in the base image: openid-connect, chat, solved, presence, data-explorer, plus 30+ others.
   • Cloned explicitly in app.yml's after_code hook: discourse-prometheus (git clone --depth 1, no ref pin — also always latest).
   • A plugin incompatibility fails launcher bootstrap at build time (step 3 below), not at deploy time, so a red GHA run here is the first signal.
2. Pick the next tag: v0.1.3.
3. Tag and push: git tag v0.1.3 && git push origin v0.1.3. This fires .github/workflows/build.yml, which runs launcher bootstrap app on an ubuntu-24.04-arm runner (arm64 image, required — workloads01's default node groups are Graviton) and pushes :v0.1.3 + :latest to ECR.
4. Confirm the build succeeded: gh run list --workflow=build.yml -R thunderbird/discourse-deploy.
5. Open a PR in this repo bumping v0.1.2 → v0.1.3 in all three manifests listed above (README §5 "Image upgrades" documents this as the standard rollout path — deliberately not :latest in the manifests, so a tag build doesn't silently replace running pods).
6. On merge, ArgoCD (discourse-app-of-apps, defined in thunderbird/platform-infrastructure) auto-syncs the new image to mzla-eks-workloads01.
7. Smoke-test: curl https://discourse.thunderbird.net/ (Cloudflare may challenge — use a browser), log in as admin (creds in mzla/discourse/app via Secrets Manager), and check Admin → Plugins for anything that silently disabled or changed behavior.

Done when

v0.1.3 is running on mzla-eks-workloads01, ArgoCD is synced clean, and the plugin list has been spot-checked post-upgrade.