feat(platform): pinnedTags map — chart resolves major to exact nightly

values.yaml

@@ -99,10 +99,31 @@ imageMirror:
 
 odoo:
   image: odoo
-  # Pinned to upstream nightly. NEVER use rolling tags (18.0, 17.0, 16.0).
-  # See odoo-tower/odoosky-odoo/versions.yaml for the canonical list and
-  # the bump procedure.
-  tag: "18.0-20260421"
+  # `tag` may be either a MAJOR reference ("18.0") or a literal pinned
+  # tag ("18.0-20260421"). When it's a major, the chart resolves it via
+  # `pinnedTags` below — that's the GitOps-clean path. Per-instance
+  # overlays should carry the major; the chart owns the exact nightly.
+  # Literal tags here are an escape hatch for staging tests.
+  tag: "18.0"
+
+  # pinnedTags — major → exact upstream nightly we have tested.
+  # MUST stay in sync with odoo-tower/odoosky-odoo/versions.yaml; that
+  # repo is the source of truth + bump policy. To bump:
+  #   1. Test the candidate nightly (see odoosky-odoo README).
+  #   2. Mirror it: nerdctl pull → tag → push to docker-mirror.
+  #   3. Update BOTH versions.yaml AND this map in the same PR.
+  #   4. ArgoCD reconciles; every instance of that major picks up the
+  #      new image on next pod restart, no overlay edits.
+  #
+  # Adding a new major: add an entry here. Tower's renderer writes the
+  # major as `odoo.tag` — adding "17.0" / "19.0" here lights up that
+  # major across every instance that asks for it.
+  pinnedTags:
+    "18.0": "18.0-20260421"
+    # "17.0": "..."   # add when 17.0 is brought into the platform
+    # "16.0": "..."   # add when 16.0 is brought into the platform
+    # "19.0": "..."   # add when 19.0 is brought into the platform
+
   # Filestore PVC size (Odoo's /var/lib/odoo).
   filestoreSize: 10Gi