deploy: pin :latest → semver across image refs

Replaces all ghcr.io/hanzoai/<svc>:latest pins with the latest published
semver tag for each service. Per CLAUDE.md auto-bump policy: mutable
branch tags (:latest, :main, :dev) are deprecated for cluster pins —
only immutable semver permitted.

Bulk update across services with published v* tags. Services without a
published semver remain on :latest until their release pipeline cuts a
v* tag.

buildscripts/upgrade-tests/compose.yml

@@ -45,7 +45,7 @@ services:
       - data4-3:/data3
 
   ingress:
-    image: ghcr.io/hanzoai/ingress:latest
+    image: ghcr.io/hanzoai/ingress:1.7.41
     volumes:
       - ./ingress.conf:/etc/ingress/config.yml:ro
     ports:

docs/orchestration/docker-compose/compose.yml

@@ -2,7 +2,7 @@ version: '3.7'
 
 # Settings and configurations that are common for all containers
 x-minio-common: &minio-common
-  image: ghcr.io/hanzoai/s3:latest
+  image: ghcr.io/hanzoai/s3:1.0.1
   command: server --console-address ":9001" http://minio{1...4}/data{1...2}
   expose:
     - "9000"