Deployed 2026-06-30 to close compute6's image-update blind spot; was running on
compute6 but not tracked. Includes the required security_opt apparmor=unconfined
(compute6 host norm) without which Diun can't read the docker socket.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
tommy