An image rebuilt weekly, and the week it was not

A scheduled base image rebuild, disabled during an incident in November, restored in February.

  the job: rebuild the base image, scan it, fail on
  critical findings. weekly, since 2023.

  disabled 2025-11-14, during an unrelated incident,
  to reduce noise.

  restored 2026-02-03, when somebody noticed the
  application build was pinned to a digest from
  November.

the staleness check that was supposed to catch this
fails the build if the base is older than 21 days.
it had been disabled in the same commit.

A guard and the thing it guards being disabled together is the ordinary shape of this failure, because both are in the same file and the change is one commit under pressure. The fix is that the staleness check now lives in the application pipeline rather than in the base image workflow, so disabling one cannot disable both.