fix(deploy): pin main-470ece8, and check pins against real builds

The upgrade failed as `pre-upgrade hooks failed: timed out waiting for the
condition`. The migrate hook was in ImagePullBackOff: tag main-11f689d does not
exist. `.forgejo/workflows/image.yaml` has a `paths:` filter that excludes
deploy/**, so the chart-only commit was green in CI and built nothing — the two
green runs on it were host-smoke and container-smoke, not build-and-push.

470ece8 carries all the code; every commit after it touches only the chart and
generated docs.

scripts/verify_image_pin.py refuses a pin whose commit has no successful
build-and-push run, and says so in those terms rather than as a timeout five
minutes later. Verified against both the bad pin and the good one; treats an
unreachable forge as inconclusive rather than as failure.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

deploy/railiance/apps/helm/state-hub-values.yaml

@@ -6,7 +6,7 @@ namespace:
 
 image:
   repository: forgejo.coulomb.social/coulomb/state-hub
-  tag: "main-11f689d"
+  tag: "main-470ece8"
 
 ingress:
   enabled: false