chore(deps): pin streaming images, isolate python and floating tags

Python Y-bumps arrived as minor 3.11->3.14 and floating tags (:latest/:beta) were automerged blindly. Pin the linuxserver stack to digest-verified tags and keep python plus rolling images in manual review groups.

renovate/k8s/configmap.yaml

@@ -218,6 +218,34 @@ data:
           "matchUpdateTypes": ["patch"],
           "groupName": "all patch updates",
           "groupSlug": "all-patch"
+        },
+        {
+          "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
+          "matchDatasources": ["docker"],
+          "matchPackageNames": ["python"],
+          "groupName": "python base image",
+          "groupSlug": "python",
+          "automerge": false
+        },
+        {
+          "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
+          "matchDatasources": ["docker"],
+          "matchPackageNames": [
+            "lscr.io/linuxserver/jellyfin",
+            "lscr.io/linuxserver/qbittorrent",
+            "lscr.io/linuxserver/sonarr",
+            "lscr.io/linuxserver/radarr",
+            "lscr.io/linuxserver/prowlarr",
+            "lscr.io/linuxserver/bazarr",
+            "ghcr.io/seerr-team/seerr",
+            "fallenbagel/jellyseerr",
+            "ghcr.io/lampac-nextgen/lampac",
+            "ghcr.io/nextcloud-releases/all-in-one",
+            "alpine/kubectl"
+          ],
+          "groupName": "floating images - manual",
+          "groupSlug": "floating-manual",
+          "automerge": false
         }
       ]
     }

renovate/renovate.json

@@ -207,6 +207,34 @@
       "matchUpdateTypes": ["patch"],
       "groupName": "all patch updates",
       "groupSlug": "all-patch"
+    },
+    {
+      "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["python"],
+      "groupName": "python base image",
+      "groupSlug": "python",
+      "automerge": false
+    },
+    {
+      "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": [
+        "lscr.io/linuxserver/jellyfin",
+        "lscr.io/linuxserver/qbittorrent",
+        "lscr.io/linuxserver/sonarr",
+        "lscr.io/linuxserver/radarr",
+        "lscr.io/linuxserver/prowlarr",
+        "lscr.io/linuxserver/bazarr",
+        "ghcr.io/seerr-team/seerr",
+        "fallenbagel/jellyseerr",
+        "ghcr.io/lampac-nextgen/lampac",
+        "ghcr.io/nextcloud-releases/all-in-one",
+        "alpine/kubectl"
+      ],
+      "groupName": "floating images - manual",
+      "groupSlug": "floating-manual",
+      "automerge": false
     }
   ]
 }

streaming/compose.yaml

@@ -1,6 +1,6 @@
 services:
   jellyfin:
-    image: lscr.io/linuxserver/jellyfin:latest
+    image: lscr.io/linuxserver/jellyfin:version-12.1ubu2604
     container_name: jellyfin
     restart: unless-stopped
     environment:
@@ -19,7 +19,7 @@ services:
       - streaming
 
   qbittorrent:
-    image: lscr.io/linuxserver/qbittorrent:latest
+    image: lscr.io/linuxserver/qbittorrent:5.2.4
     container_name: qbittorrent
     restart: unless-stopped
     environment:
@@ -38,7 +38,7 @@ services:
       - streaming
 
   sonarr:
-    image: lscr.io/linuxserver/sonarr:latest
+    image: lscr.io/linuxserver/sonarr:4.0.20
     container_name: sonarr
     restart: unless-stopped
     environment:
@@ -55,7 +55,7 @@ services:
       - streaming
 
   radarr:
-    image: lscr.io/linuxserver/radarr:latest
+    image: lscr.io/linuxserver/radarr:6.4.4
     container_name: radarr
     restart: unless-stopped
     environment:
@@ -72,7 +72,7 @@ services:
       - streaming
 
   prowlarr:
-    image: lscr.io/linuxserver/prowlarr:latest
+    image: lscr.io/linuxserver/prowlarr:2.6.5
     container_name: prowlarr
     restart: unless-stopped
     environment:
@@ -100,7 +100,7 @@ services:
       - streaming
 
   bazarr:
-    image: lscr.io/linuxserver/bazarr:latest
+    image: lscr.io/linuxserver/bazarr:1.6.2
     container_name: bazarr
     restart: unless-stopped
     environment: