feat(apps): track the last untracked apps' upstreams

Five apps had no app.upstream block, so nothing could ever tell us
when their pins fell behind upstream:

  barkd           gitlab ark-bitcoin/bark   (GitLab-only project)
  immich-postgres ghcr  immich-app/postgres (image exists only on ghcr.io)
  indeedhub-minio github minio/minio
  pine-whisper    dockerhub rhasspy/wyoming-whisper
  lightning-stack manual — no public listing exists for
                   lightninglabs/lightning-stack anywhere (docker.io,
                   ghcr.io, github.com all checked), so it is tracked by hand

This adds two fetchers to scripts/check-upstream-releases.py to reach the
first two: latest_gitlab (GitLab releases API; strips the project-name
tag prefix, e.g. bark-0.6.2 -> 0.6.2) and latest_ghcr (anonymous pull
token + tags/list, the same handshake a docker pull performs).

Live-verified after the change:
  barkd            0.3.0 -> 0.6.2   (bump gated on ark_client.rs REST compat)
  immich-postgres  14-vectorchord0.4.3-pgvectors0.2.0 -> 17-vectorchord0.4.3-pgvector0.8.0
  indeedhub-minio  RELEASE.2024-11-07T00-52-20Z -> latest (date-opaque: UNCOMPARABLE, shown for hand comparison)
  pine-whisper     3.4.1 -> 3.6.0   (tuned-args revision needs re-basing, not just a pin move)

Offline coverage check: 59 apps, 0 untracked.

scripts/check-upstream-releases.py

@@ -39,6 +39,7 @@ import os
 import re
 import sys
 import urllib.error
+import urllib.parse
 import urllib.request
 from dataclasses import dataclass, field
 from pathlib import Path
@@ -191,7 +192,50 @@ def _highest(tags: list[str], current: str = "") -> str:
     return max(ranked)[1]
 
 
-FETCHERS = {"github": latest_github, "dockerhub": latest_dockerhub}
+def latest_gitlab(project: str, current: str = "") -> str:
+    """Newest release tag for a GitLab `group/project`.
+
+    Some projects publish releases only on GitLab with no GitHub mirror
+    (bark lives at ark-bitcoin/bark and nowhere else). GitLab release tags
+    sometimes carry the project name as a prefix (`bark-0.6.2`); strip it so
+    version ordering can see the number.
+    """
+    esc = urllib.parse.quote(project, safe="")
+    releases = http_json(
+        f"https://gitlab.com/api/v4/projects/{esc}/releases?per_page=100"
+    )
+    tags = [str(r["tag_name"]) for r in releases]
+    prefix = project.rsplit("/", 1)[-1].lower() + "-"
+    tags = [t[len(prefix):] if t.lower().startswith(prefix) else t for t in tags]
+    return _highest(tags, current)
+
+
+def latest_ghcr(repo: str, current: str = "") -> str:
+    """Newest version-like tag on GitHub's container registry.
+
+    Some images exist only on ghcr.io (immich-app/postgres publishes there
+    and nowhere else), so neither the GitHub-release nor the Docker Hub
+    fetcher can see them. Anonymous pull token first, then the tag list —
+    the same handshake any `docker pull ghcr.io/...` performs.
+    """
+    token = http_json(
+        f"https://ghcr.io/token?scope=repository:{repo}:pull&service=ghcr.io"
+    )["token"]
+    req = urllib.request.Request(
+        f"https://ghcr.io/v2/{repo}/tags/list",
+        headers={"User-Agent": USER_AGENT, "Authorization": f"Bearer {token}"},
+    )
+    with urllib.request.urlopen(req, timeout=TIMEOUT) as res:  # noqa: S310
+        tags = [str(t) for t in json.loads(res.read().decode()).get("tags", [])]
+    return _highest(tags, current)
+
+
+FETCHERS = {
+    "github": latest_github,
+    "dockerhub": latest_dockerhub,
+    "gitlab": latest_gitlab,
+    "ghcr": latest_ghcr,
+}
 
 
 # ── Manifest reading ───────────────────────────────────────────────────────