Deploy StarPunk from its CI-built image

StarPunk's Gitea Actions workflow now builds and pushes the image on
vX.Y.Z tags. Pin the tag in starpunk_version (v2.0.2, the first CI build)
and always pull it, so an image built by hand on the server with the
same name can't be deployed instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/docker/README.md

@@ -58,7 +58,7 @@ Tags: each category file has a category tag, each service its own tag.
 |---|---|---|
 | `gotosocial` | GoToSocial | Pocket ID through env vars. Account domain is the apex; Caddy serves WebFinger there. Daily S3 backup of its volume. |
 | `listmonk` | Listmonk | Postgres 17. On `listmonk.nerder.land`. |
-| `starpunk` | StarPunk | Micropub server for the main site (own image from Gitea). Admin login via Pocket ID; issues its own Micropub tokens. |
+| `starpunk` | StarPunk | Micropub server for the main site. Image built by the StarPunk repo's Gitea Actions on `vX.Y.Z` tags; deploy a release by bumping `starpunk_version`. Admin login via Pocket ID; issues its own Micropub tokens. |
 
 ### Monitoring (`monitoring`)
 | Tag | Service | Notes |

roles/docker/tasks/communication/starpunk.yml

@@ -17,5 +17,8 @@
 - name: deploy starpunk stack
   community.docker.docker_compose_v2:
     project_src: /opt/stacks/starpunk
+    # Always fetch the tag from the registry so a locally built image with
+    # the same name can't be deployed by mistake
+    pull: always
     files:
     - compose.yml

roles/docker/templates/starpunk-compose.yml.j2

@@ -1,6 +1,7 @@
 services:
   starpunk:
-    image: git.thesatelliteoflove.com/phil/starpunk:v2.0.1
+    # Built and pushed by StarPunk's Gitea Actions workflow on vX.Y.Z tags
+    image: {{ subdomains.git }}/phil/starpunk:{{ starpunk_version }}
     container_name: starpunk
     restart: unless-stopped
     extra_hosts: