chore(sponsord): pin decdn/sponsord v0.0.4

[alpergundogdu]

What

Pins decdn/sponsord v0.0.4 for both roles and the Compose example, following roles/sponsord/README.md § Bumping the sponsord release:

1. sponsord_version and sponsord_onramp_version → 0.0.4.
2. SPONSORD_IMAGE_DIGEST / SPONSORD_ONRAMP_IMAGE_DIGEST in compose/.env.example from the release's sponsord-image-digest.txt and sponsord-onramp-image-digest.txt.
3. files/sponsord-release-KEYS.asc: unchanged (identical to upstream KEYS at v0.0.4).
4. Config env vars: crates/*/src/config.rs is unchanged between v0.0.3 and v0.0.4, so the Compose file and role templates need nothing.
5. Every doc that names the version. The collections' changelogs are untouched: publisher-collection-v0.1.0 made their [Unreleased] sections released, generated ones, and the next section comes from this PR's title.

v0.0.4 ships decdn/sponsord#73: the installers take the hash first and pass every later argument to decdn bundle pull (with -o . by default). The onramp's installer decdn pin stays at decdn/decdn v0.0.4 from #150.

Reviewer notes

• Merge after the release is signed. At the time of opening, the v0.0.4 GitHub release is still a draft awaiting scripts/sign-release.sh v0.0.4, so its SHA256SUMS.asc and image tags don't exist yet. A release-mode deploy verifies that signature.
• make test-scripts couldn't finish locally (macOS has no util-linux flock).

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The core change is opaque image-digest values tied to a draft, not-yet-signed upstream release that cannot be verified here, so a human/CI must confirm the digests and merge timing.

0 open findings

What changed in this PR

Pins decdn/sponsord to v0.0.4 across both Ansible roles (sponsord, sponsord_onramp), the Docker Compose example image digests, and all prose/changelog references that name the release. This keeps the sponsord deploy paths aligned on a single upstream workspace release, following the "Bumping the sponsord release" checklist.

Changes:

• Bump sponsord_version and sponsord_onramp_version defaults from 0.0.3 → 0.0.4 (and the matching fail_msg/README/changelog prose).
• Update SPONSORD_IMAGE_DIGEST / SPONSORD_ONRAMP_IMAGE_DIGEST in compose/.env.example to the v0.0.4 release digests.
• Refresh version strings in AGENTS.md, READMEs, inventory examples, and the publisher collection's [Unreleased] changelog.

File	Description
ansible/​roles/​sponsord/​defaults/​main.yml	Bumps sponsord_version default to 0.0.4.
ansible/​roles/​sponsord_onramp/​defaults/​main.yml	Bumps sponsord_onramp_version default to 0.0.4.
ansible/​roles/​sponsord/​tasks/​main.yml	Updates the release-mode fail_msg example to 0.0.4.
ansible/​roles/​sponsord_onramp/​tasks/​main.yml	Updates the release-mode fail_msg example to 0.0.4.
ansible/​roles/​sponsord/​README.md	Documents the new 0.0.4 default and source tag example.
ansible/​roles/​sponsord_onramp/​README.md	Documents the new 0.0.4 default pin.
ansible/​README.md	Notes sponsord roles now pin 0.0.4.
ansible/​inventory/​group_vars/​sponsord_hosts.yml	Updates commented version/source-ref examples.
ansible/​inventory/​group_vars/​sponsord_onramp_hosts.yml	Updates commented version/source-ref examples.
ansible/​galaxy/​publisher/​README.md	Updates the release pin mentioned in the role table.
ansible/​galaxy/​publisher/​CHANGELOG.md	Updates the pinned version in the [Unreleased] section.
AGENTS.md	Updates the pinned-release prose to 0.0.4.
compose/​.env.example	Sets the v0.0.4 sponsord/onramp image digests and comment.
compose/​README.md	Updates the pinned-release note to 0.0.4.
cloud-init/​README.md	Updates the sponsor release note to v0.0.4.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.