pin immich ver to 2.7.5

clusters/base/apps/immich/helmrelease-ml.yaml

@@ -19,8 +19,12 @@ spec:
             # need specific host devices (e.g. /dev/dri) that aren't set up
             # on these nodes. Switch tags later if that changes.
             image:
+              # pinned to match immich-server's version (see
+              # helmrelease-server.yaml) - server and ML communicate over
+              # an internal API contract that isn't guaranteed compatible
+              # across versions.
               repository: ghcr.io/immich-app/immich-machine-learning
-              tag: release
+              tag: v2.7.5
             env:
               TZ: Europe/Moscow
             resources:

clusters/base/apps/immich/helmrelease-server.yaml

@@ -76,7 +76,16 @@ spec:
           app:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: release
+              # pinned to match the DB backup being restored
+              # (immich-db-backup-20260711T020000-v2.7.5-pg14.19.sql.gz) -
+              # a newer server expects a newer DB schema than what that
+              # backup contains, so it has to match at restore time. Once
+              # the restore is done and v2.7.5 has come up cleanly against
+              # it, bump back to "release" - v2.7.5's own migrations will
+              # carry the schema forward from there, which is the safe
+              # supported upgrade path (vs. jumping straight to a much
+              # newer server against a much older schema).
+              tag: v2.7.5
             env:
               TZ: Europe/Moscow
               DB_HOSTNAME: immich-postgres