Finish automatic update tracking for the last few production services

What this is

Every Think service should pick up new versions of the software behind it automatically, so security fixes and improvements arrive without waiting for someone to notice them.

Where it stands

As of 2026-08-13 this covers the large majority of production services, each verified against what is genuinely running rather than against what the tooling claims. Three services are still outstanding.

Two services were deliberately left out: they track their versions a different way, and adding a second mechanism on top would give the same setting two owners and stop updates from reaching them at all.

The work also turned up one service whose update tracking had been reporting success while pointing at a setting that did not exist — that is now fixed, and every remaining service is being verified the same way rather than trusted.