chore(althing): pin the post office to 3.7.0

Canonical pin bump for the 3.7.0 rollout forseti approved and released
(althing 6db955f, tag v3.7.0). Image built from that tree and pushed as
sha256:df0709b3f532557aebb47d6ece486ae32e851776f732862094608d55eefcd4e7;
previous pin was 3.6.3@sha256:978f8553 and remains the rollback target.

Content-verified rather than tag-verified: `postbox --version` inside the
built image reports 3.7.0 before it was pushed, and again inside the running
container after. A tag is a claim.

Also adds playbooks/nh3-extdev-althing-upgrade.yaml -- a version-parameterised
upgrade for the box a git pull cannot move. The existing
nh3-extdev-althing-v3.yaml is the historical v2->v3 CUTOVER and is left alone
rather than mutated per release; it still carries v2-retirement steps that
document what happened.

Every check in the new playbook asserts what the installed entry point
reports, including one that the herald restarted within the last 5 minutes
rather than surviving from before -- "active" does not mean "running the code
you just installed".

playbooks/nh3-extdev-althing-upgrade.yaml

@@ -0,0 +1,60 @@
+# Upgrade althing on nh3-extdev to a given release. Version-parameterised and
+# rerunnable — the sibling `nh3-extdev-althing-v3.yaml` is the historical
+# v2→v3 CUTOVER and should not be mutated per release.
+#
+#   scripts/elway infra-ops@10.100.50.42 \
+#     --playbook playbooks/nh3-extdev-althing-upgrade.yaml --var version=3.7.0
+#
+# ⚠ nh3-extdev is the box a `git pull` cannot move. althing is a system WHEEL
+# at /opt/uv-tools/althing-core, entry points in /usr/local/bin, its herald is
+# a SYSTEM unit (not a user unit like nh3-dev's), and `uv` is not on lkraven's
+# PATH — it lives at /home/infra-ops/.local/bin/uv. BOTH UV_TOOL_DIR and
+# UV_TOOL_BIN_DIR are required; setting only one installs to the wrong place.
+#
+# ⚠ `uv tool install` WITHOUT --force IS A SILENT NO-OP — uv matches the source
+# SPEC, not its contents, so on a box that already installed from this path it
+# prints "already installed" and exits 0 having done nothing.
+#
+# ⚠ VERIFY THE BINARY, NOT THE TAG. Every check below asserts the version the
+# installed entry point actually reports. A wheel filename is a claim.
+vars:
+  version: "3.7.0"
+  uv: /home/infra-ops/.local/bin/uv
+  tool_dir: /opt/uv-tools
+  bin_dir: /usr/local/bin
+
+steps:
+  - name: Stage the release wheel
+    upload:
+      src: /tmp/althing-release-3.7.0/althing_core-3.7.0-py3-none-any.whl
+      dest: /tmp/althing_core-{{ version }}-py3-none-any.whl
+      mode: "0644"
+
+  - name: Record the version we are replacing
+    shell: "{{ bin_dir }}/postbox --version"
+
+  - name: Install the staged wheel over the system wheel install
+    sudo: true
+    shell: env UV_TOOL_DIR={{ tool_dir }} UV_TOOL_BIN_DIR={{ bin_dir }} {{ uv }} tool install --force /tmp/althing_core-{{ version }}-py3-none-any.whl
+    # Idempotent on the INSTALLED VERSION, not on the wheel's presence.
+    when: "test \"$({{ bin_dir }}/postbox --version | awk '{print $2}')\" != '{{ version }}'"
+
+  - name: Restart the herald so the new code is what is actually running
+    sudo: true
+    shell: systemctl restart althing-po-herald.service
+
+verify:
+  - name: the installed binary reports the new version
+    shell: "test \"$({{ bin_dir }}/postbox --version | awk '{print $2}')\" = '{{ version }}'"
+    changed_when: "false"
+  - name: the herald is running, and on the new code
+    sudo: true
+    shell: systemctl is-active --quiet althing-po-herald.service
+    changed_when: "false"
+  - name: the herald restarted just now rather than surviving from before
+    sudo: true
+    shell: "test $(( $(date +%s) - $(date -d \"$(systemctl show althing-po-herald.service -p ActiveEnterTimestamp --value)\" +%s) )) -lt 300"
+    changed_when: "false"
+  - name: the v2 entry points are still gone
+    shell: "! test -e {{ bin_dir }}/althing-cli && ! test -e {{ bin_dir }}/althing-receiver"
+    changed_when: "false"

stacks/althing-post-office/compose.yaml

@@ -51,7 +51,7 @@ services:
     # Digest-pinned, not tag-floating: `:3.0.0` is a mutable pointer on a registry
     # anyone can re-push, and this container is the fleet's whole message bus. The
     # tag is kept alongside the digest purely so a human can read what it is.
-    image: gitea.phasefinal.com/claude-bot/althing-post-office:3.6.3@sha256:978f85533674ee248d6c6f29c54ffab0bc2cb16332c18c9fb8bfda1d566e2de4
+    image: gitea.phasefinal.com/claude-bot/althing-post-office:3.7.0@sha256:df0709b3f532557aebb47d6ece486ae32e851776f732862094608d55eefcd4e7
     container_name: althing-post-office
 
     # ─── Host networking, so the bind guard keeps working ────────────