Bring every service's build pipeline up to the current standard

What this is

Think deploys every service from a small number of shared templates. Over time individual services drift away from the template, so a fix made once has to be re-made by hand in the places that no longer match — which is how defects survive after they are supposedly fixed.

Where it stands

Both shared templates were brought up to date on 2026-08-10, including the security-scanning settings and the project-metadata job that had been writing to the wrong project. Rolling those same corrections out to every service that has drifted is in progress.

A handful of services fail their security scan after being brought up to standard and need individual attention rather than a bulk change. Those are being worked through one at a time.