chore: pin decdn to v0.0.4

[thiras]

Moves the decdn/decdn pin to v0.0.4 from v0.0.3.

• decdn changes: decdn/decdn@v0.0.3...v0.0.4
• SHA256SUMS (bc295285109e2189331e57d9cb51d214113cba332bd08a2777866a7a1cec2951) and the decdn-node image digest (sha256:7c303b6105a1b419c0f7e3ef57d8ad3ba23d07cccba0d42332699fd409133f0a)
  come from the release's assets, verified against ansible/roles/decdn_node/files/decdn-release-KEYS.asc.

Before merging:

• Validate the chart against the release's binary (CI has none):
  DECDN_CLI=<v0.0.4's decdn> make lint-helm.

• Move the prose that still names 0.0.3 (a decdn/sponsord pin may
  share the number; leave those):

  AGENTS.md:144:`0.0.3`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
  AGENTS.md:145:today `0.0.3`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
  AGENTS.md:198:  release's GPG-signed `SHA256SUMS` (`decdn_node_version`, default `0.0.3`); `source` — a git ref (any tag/branch/SHA) cloned and `cargo build`-ed **on the
  AGENTS.md:295:    (`sponsord_version`, `0.0.3`), a host-side `source` build, or a manual binary.
  ansible/README.md:177:     (`0.0.3`); the sponsord roles pin decdn/sponsord `0.0.3` the same way.
  ansible/README.md:501:| `decdn_node_install_method` | `release` | `release` (the pinned `decdn_node_version`, `0.0.3`), `source` (build `decdn_node_source_ref` on the node) or `manual` (copy a control-machine build). |
  ansible/galaxy/publisher/README.md:14:| `decdn.publisher.sponsord` | The `sponsord` onboarding sponsor (treasury signer + PaymentPool keeper), standalone or beside a node — local binary, a host-side source build or a GPG-verified decdn/sponsord `v*` release (pinned to 0.0.3), `DynamicUser` unit with the API token and treasury wallet as systemd credentials, loopback-only API, `/healthz` deploy gate. `sponsord_network` sets the chain and PaymentPool from upstream's manifest. Restarts refuse while a pool top-up is held; `tasks_from: backup` / `decommission` for day 2. |
  ansible/galaxy/publisher/README.md:15:| `decdn.publisher.sponsord_onramp` | `sponsord-onramp`, sponsord's public side (Turnstile gate, installers, capability API), on the daemon's host — local binary, a host-side source build or a GPG-verified decdn/sponsord `v*` release (pinned to 0.0.3), `DynamicUser` unit with the daemon token and Turnstile secret as systemd credentials, loopback listener behind Caddy (distro package, ACME TLS, admin API off; or your own proxy), `/healthz` deploy gate; `tasks_from: decommission`. |
  ansible/inventory/group_vars/sponsord_hosts.yml:17:# sponsord_version: "0.0.3"
  ansible/inventory/group_vars/sponsord_hosts.yml:21:# sponsord_source_ref: v0.0.3
  ansible/inventory/group_vars/sponsord_onramp_hosts.yml:15:# sponsord_onramp_version: "0.0.3"
  ansible/inventory/group_vars/sponsord_onramp_hosts.yml:18:# sponsord_onramp_source_ref: v0.0.3
  ansible/inventory/group_vars/sponsord_onramp_hosts.yml:36:# v0.0.3), with the SHA-256 of its SHA256SUMS. To serve another, set both:
  ansible/inventory/group_vars/sponsord_onramp_hosts.yml:37:# sponsord_onramp_decdn_release: v0.0.3
  ansible/inventory/host_vars/decdn-node-1/main.yml:26:# decdn_node_version: "0.0.3"
  ansible/inventory/host_vars/decdn-node-1/main.yml:32:#     decdn_node_source_ref: v0.0.3
  ansible/inventory/host_vars/origin-1/main.yml:28:# decdn_node_version: "0.0.3"
  ansible/inventory/host_vars/origin-1/main.yml:34:#     decdn_node_source_ref: v0.0.3
  ansible/roles/decdn_node/README.md:10:**Pinned release.** `decdn_node_version` defaults to `0.0.3`, the decdn/decdn
  ansible/roles/decdn_node/README.md:15:`decdn/decdn` v0.0.3, the release `decdn_node_version` pins. Upstream marks every config
  ansible/roles/decdn_node/README.md:54:     `decdn_node_version` (default `0.0.3`) names the `v<version>` release, which
  ansible/roles/decdn_node/README.md:106:       `decdn_node_source_ref` to its tag (`v0.0.3`).
  ansible/roles/sponsord/README.md:23:    `v<version>` release of `decdn/sponsord` (`sponsord_version`, default `0.0.3`;
  ansible/roles/sponsord/README.md:35:    release tag (`v0.0.3`) to build exactly that release. The build user, its home and the toolchain are
  ansible/roles/sponsord/README.md:130:| `sponsord_version` | `0.0.3` | `release` mode: the `decdn/sponsord` release (tag `v0.0.3`). Equal to `sponsord_onramp_version`. |
  ansible/roles/sponsord/defaults/main.yml:55:sponsord_version: "0.0.3"         # asserted non-empty in "release" mode
  ansible/roles/sponsord/tasks/main.yml:26:      "0.0.3") naming a v<version> release of decdn/sponsord (or of the mirror in
  ansible/roles/sponsord_onramp/README.md:26:    default `0.0.3`, the same release as the daemon's) and verifies it against the
  ansible/roles/sponsord_onramp/README.md:103:   pins: the decdn/decdn `v0.0.3` tag and the SHA-256 of that release's
  ansible/roles/sponsord_onramp/README.md:121:| `sponsord_onramp_version` | `0.0.3` | `release` mode: the `decdn/sponsord` release (tag `v0.0.3`). Keep it equal to `sponsord_version`: overriding one does not move the other. |
  ansible/roles/sponsord_onramp/README.md:135:| `sponsord_onramp_decdn_release`, `_decdn_sums_sha256` | `v0.0.3`, its digest | A decdn/decdn `vX.Y.Z` tag and 64 lowercase hex. The default follows the `decdn_node` role's pin; a host override of `decdn_node_version` does not move it. |
  ansible/roles/sponsord_onramp/defaults/main.yml:53:sponsord_onramp_version: "0.0.3"         # asserted non-empty in "release" mode
  ansible/roles/sponsord_onramp/tasks/main.yml:29:      sponsord_onramp_version (e.g. "0.0.3") naming a v<version> release of
  charts/decdn-node/README.md:63:  (today `0.0.3`, the decdn/decdn release the chart is synced against). Pin
  cloud-init/README.md:41:> one the roles pin at `DEVOPS_REF` (decdn/decdn `v0.0.3` today, decdn/sponsord
  cloud-init/README.md:42:> `v0.0.3` for the sponsor); set `decdn_node_version` in the user-data to pin
  cloud-init/user-data-publisher.yaml:143:          # sponsord_onramp_decdn_release: "v0.0.3"
  compose/.env.example:44:# decdn/sponsord v0.0.3, one release for both images
  compose/README.md:72:roles pin (decdn/decdn v0.0.3, decdn/sponsord v0.0.3), each copied from that
  

After merging, release each artifact the bump touched (RELEASING.md).

Opened by scripts/open-decdn-bump.sh. A red CI means the new decdn needs
changes here: push them to this branch.

[Copilot]

🟡 Changes recommended

Stale v0.0.3 operator guidance remains, and the mandatory v0.0.4 binary validation is not recorded as completed.

2 open findings

• Update stale decdn/decdn v0.0.3 references in operator examples · New
• Run real-binary validation for rendered v0.0.4 chart configuration · New

What changed in this PR

Updates deployment paths from decdn/decdn v0.0.3 to v0.0.4.

Changes:

• Updates Ansible, Compose, Helm, and onramp release pins.
• Regenerates network-profile provenance.
• Updates validation fixtures and collection changelogs.

File	Description
compose/​sponsord-onramp.env.example	Updates installer release and checksum.
compose/​.env.example	Updates node image digest.
charts/​decdn-node/​values.yaml	Updates example production digest.
charts/​decdn-node/​Chart.yaml	Updates app and Artifact Hub image versions.
ansible/​roles/​sponsord/​vars/​main/​networks.yml	Records new upstream source commit.
ansible/​roles/​sponsord_onramp/​vars/​main/​networks.yml	Records new upstream source commit.
ansible/​roles/​sponsord_onramp/​defaults/​main.yml	Updates installer release defaults.
ansible/​roles/​decdn_node/​vars/​main/​networks.yml	Records new upstream source commit.
ansible/​roles/​decdn_node/​defaults/​main.yml	Updates the node release default.
ansible/​molecule/​validation-sponsord/​converge.yml	Updates pin-pair validation fixture.
ansible/​galaxy/​publisher/​CHANGELOG.md	Documents the onramp pin.
ansible/​galaxy/​node/​CHANGELOG.md	Documents the node pin.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.