dunn.dev/pipeline 4.2.0 Four correctness fixes, no new inputs, no removed/renamed inputs -- follows 4.1.0's minor-not-patch precedent. Fixed - container-image: builder image (quay.io/buildah/stable) repinned off a :latest that quay.io proved (2026-08) rebuilds in place across v1.43.1, v1.43, v1, and latest alike -- untracked drift, not "always current." Repinned to v1.43.1-immutable@sha256:fc649e18..., a real non-rebuilt tag Renovate can track and bump. - renovate.json templates/*.yml customManager: the sole matchString required a quoted default: value, so container-image.yml's bare image: quay.io/buildah/stable:latest was invisible to it. Added an image:/name: key variant (quoted or bare, digest optional). - reference-check: every API-backed assertion in dunn.dev/reference's primitives (check_gitlab_setting, check_registry_cleanup_coverage) was a silent no-op in CI since introduction -- ci never installed glab, the recipe never set PROJECT_ID. Fixed: ci now bakes glab (checksum-verified, version-pinned to harness/mise.toml's gitlab-org/cli pin); the recipe exports PROJECT_ID from CI_PROJECT_ID plus GLAB_ENABLE_CI_AUTOLOGIN=true. That alone still 403'd on the general Projects API (CI_JOB_TOKEN's job-token-access table doesn't cover GET /projects/:id). Closed by a read_api group access token, wired as group CI variable GITLAB_TOKEN (masked, unprotected, glab's own higher-precedence-than-CI_JOB_TOKEN env var -- confirmed via `glab auth login --help`, and empirically: a CI_JOB_TOKEN-authenticated call would 403 on this endpoint rather than return real settings). Proven end-to-end against a real job (dunn.dev/reference, throwaway branch, this catalog's own ci image): check_registry_cleanup_coverage reads and reports a real live value (PASS ... cleanup disabled (enabled=false), job 15676948764), and a throwaway deliberate-violation assertion reports a real FAIL against real data (FAIL ... default_branch = main (expected /this-branch-does-not-exist/), job 15677067064). fail_on_violation stays false estate-wide: all 9 current consumers were audited against live state and every one fails at least one contract today (pre-existing, unrelated gaps). Fix violations first, then enforce. - renovate-config preset: the cloudflare workers ecosystem group matched almost nothing -- matchUpdateTypes:["major"] excluded wrangler's peer bump to @cloudflare/workers-types ^5 at 4.108.0, a minor, so the group MR only ever carried the types half (the exact ERESOLVE the rule existed to prevent). Dropped matchUpdateTypes entirely. Tag convention unchanged since 2.0.0: bare semver, no v-prefix. See CHANGELOG.md for the full entry.