The backend leg updated web/worker/lake but not daemon, so the first
backend roll after the stack gained the service left the daemon a release
behind web — a version skew across the /internal/* contract that pinning
one BACKEND_IMAGE_TAG exists to prevent. Same tolerate-missing pattern as
lake. Prod's daemon was rolled to the current image by hand.