chore(althing): pin the post office to 3.7.0

Canonical pin bump for the 3.7.0 rollout forseti approved and released
(althing 6db955f, tag v3.7.0). Image built from that tree and pushed as
sha256:df0709b3f532557aebb47d6ece486ae32e851776f732862094608d55eefcd4e7;
previous pin was 3.6.3@sha256:978f8553 and remains the rollback target.

Content-verified rather than tag-verified: `postbox --version` inside the
built image reports 3.7.0 before it was pushed, and again inside the running
container after. A tag is a claim.

Also adds playbooks/nh3-extdev-althing-upgrade.yaml -- a version-parameterised
upgrade for the box a git pull cannot move. The existing
nh3-extdev-althing-v3.yaml is the historical v2->v3 CUTOVER and is left alone
rather than mutated per release; it still carries v2-retirement steps that
document what happened.

Every check in the new playbook asserts what the installed entry point
reports, including one that the herald restarted within the last 5 minutes
rather than surviving from before -- "active" does not mean "running the code
you just installed".

stacks/althing-post-office/compose.yaml

@@ -51,7 +51,7 @@ services:
     # Digest-pinned, not tag-floating: `:3.0.0` is a mutable pointer on a registry
     # anyone can re-push, and this container is the fleet's whole message bus. The
     # tag is kept alongside the digest purely so a human can read what it is.
-    image: gitea.phasefinal.com/claude-bot/althing-post-office:3.6.3@sha256:978f85533674ee248d6c6f29c54ffab0bc2cb16332c18c9fb8bfda1d566e2de4
+    image: gitea.phasefinal.com/claude-bot/althing-post-office:3.7.0@sha256:df0709b3f532557aebb47d6ece486ae32e851776f732862094608d55eefcd4e7
     container_name: althing-post-office
 
     # ─── Host networking, so the bind guard keeps working ────────────