Found while checking live status: beta's thermograph-daemon container was
still running an old backend image tag while backend/lake had rolled
forward twice. Reproduced directly against the host rather than guessing --
`docker compose config --images daemon` does NOT filter to the named
service on this host's Compose v5.3.1: it prints every service's image,
one per line, in file order, so `| head -1` was silently grabbing db's
image (timescaledb) instead of daemon's. The probe then always found no
/usr/local/bin/thermograph-daemon in a Postgres image and concluded "this
image predates the daemon binary," dropping daemon from every single
backend deploy regardless of what the real backend image actually
contained -- the exact /internal/* version-skew this guard was written to
prevent, caused by the guard itself.
Fixed by building the image reference directly from the same vars
docker-compose.yml's daemon.image: already interpolates
(REGISTRY_HOST/BACKEND_IMAGE_PATH/BACKEND_IMAGE_TAG) instead of going
through `docker compose config` at all -- no dependency on that command's
filtering behavior, and it can't disagree with what compose will actually
run.
Verified directly against beta: the old code's exact command sequence
reproduced with real secrets sourced, confirmed the wrong (db) image was
selected; the new construction resolves to the correct backend image and
the binary probe passes.
