fix(deploy): refresh env during image updates

[ericmey]

No tracking Issue: deploy exposed an update-playbook gap during the v1.11.4 rollout.

Summary

• render .env.production during deploy/ansible/update.yml before service recreation, so MUSUBI_SERVICE_VERSION advances with the pinned image
• notify upgrade-history handlers from the recreate task, so update runs append /var/log/musubi/upgrade-history.jsonl as the runbook promises
• add structural tests for both behaviors

Validation

• uv run pytest tests/ops/test_update_playbook.py tests/ops/test_ansible.py
• uv run ruff format --check tests/ops/test_update_playbook.py
• uv run ruff check tests/ops/test_update_playbook.py
• ansible-playbook -i deploy/ansible/inventory.yml --syntax-check deploy/ansible/update.yml

[Copilot]

Pull request overview

This PR closes an operational gap in the Ansible in-place upgrade flow by ensuring deploy/ansible/update.yml refreshes the rendered production env file before recreating services, and by wiring the per-service recreate task to append an upgrade-history entry as described in the upgrade runbook. It adds structural unit tests to prevent future drift.

Changes:

• Render {{ musubi_config_dir }}/.env.production during update.yml before the docker_compose_v2 recreate step (with no_log: true).
• Add notify hooks on the per-service docker_compose_v2 task to trigger the upgrade-history handlers.
• Add structural tests asserting env refresh ordering and that the recreate task notifies the upgrade-history handlers.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
deploy/ansible/update.yml	Adds .env.production templating pre-recreate and ensures the recreate step notifies upgrade-history handlers.
tests/ops/test_update_playbook.py	Adds structural tests enforcing env refresh ordering and upgrade-history notification wiring.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.