[NinjaLikesCheez]

Closes #73.

just deploy-dev pins Azure dev to a GHCR SHA via az containerapp update. Terraform still had container_image on the Container App, so a later just tf-apply dev with a stale gitignored tfvars SHA could roll the bot backward.

Chosen approach: Terraform lifecycle.ignore_changes on the dev Pixel container image only (azurerm_container_app.this). Apply still manages vault, volume, env and the replica pin. After first create, just deploy-dev / az owns the running dev image.

Prod is not ignored. Terraform cannot condition ignore_changes, so #12 uses a second resource (azurerm_container_app.managed) with no image ignore. Prod apply will set container_image. A moved block keeps live pixel-dev as this[0] (address change only; not a replace).

Not in this PR: no prod apply, no second running app, replica count stays min = max = 1, CD still does not apply Terraform.

Docs

• Runbook Azure + Deploys: dev image is owned by just deploy-dev; first apply after merge moves this → this[0]
• ADR 0009 / 0010: ignore is dev-only; prod apply sets the image
• CHANGELOG.md Unreleased (Fixed)
• Variable / example-tfvars comments and infra READMEs

This does not change core/access*, identity, dispatcher, registry, or access-config.

How to verify

just tf-validate
just check

With Azure login (does not apply):

az containerapp show -g pixel-dev -n pixel-dev --query "properties.template.containers[0].image" -o tsv
just tf-plan dev
# Plan must not propose changing the running image back.
# It may show a move: azurerm_container_app.this → this[0] (not destroy/create).

Leftover human steps

• Review and merge. The next just tf-plan dev / just tf-apply dev uses this lifecycle (plan should omit the image rollback). Expect a state move, not a replace. Do not apply until a maintainer says so.
• Do not apply prod (Prod environment, approval gate and go-live in the Pixelbar server #12). Do not apply Terraform from CD.
• To change the running dev image, keep using just deploy-dev or az containerapp update (min=max=1).
• When Prod environment, approval gate and go-live in the Pixelbar server #12 lands, point container_image at the GHCR SHA; that apply will roll the prod app.