Fix pihole for v6: pin digest, listeningMode=ALL, v6 password env, readiness probe

A fresh node pull of pihole:latest silently upgraded v5->v6 (Core v6.2.2).
v6's default listeningMode=LOCAL drops DNS from non-attached subnets, which
killed all cross-node svclb DNS the moment the pod rescheduled off its old
node. v6 also ignores the WEBPASSWORD env.

- image pinned by digest (Core v6.2.2)
- FTLCONF_dns_listeningMode=ALL
- admin password via FTLCONF_webserver_api_password <- pihole-admin secret
- tcpSocket:53 readiness probe so rollout status waits for FTL

Applied to the cluster via kubectl replace; DNS verified answering on all
four node IPs, admin API auth verified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -85,7 +85,10 @@ to secrets and no delete verbs.
 ## Known quirks (faithful to live state, fix at leisure)
 
 - Most images are `:latest`/`:stable` — deploys are not reproducible until
-  pinned. vaultwarden is pinned (1.35.4).
+  pinned. vaultwarden is pinned (1.35.4); pihole is pinned by digest (Core
+  v6.2.2) after `:latest` silently jumped v5→v6 on a fresh node pull
+  (2026-07-26) and broke DNS for cross-node sources (v6 defaults to
+  `listeningMode=LOCAL`) — fixed via `FTLCONF_dns_listeningMode=ALL`.
 - searxng keeps its helm-generated name suffix (`searxng-1723974683`) because
   deployment selectors are immutable; its helm release record still exists in
   the cluster — don't run `helm upgrade/uninstall` on it, this repo is the
@@ -103,4 +106,8 @@ to secrets and no delete verbs.
   `rpi-master_undervoltage_CNI_corruption_incident-2026-07-25.md`.
 - 2026-07-26: initial import of manifests from live cluster; HA ingress
   defaultBackend fixed; unifiedstreaming-svc LoadBalancer→ClusterIP;
-  pihole/USP secrets moved to secretKeyRef (pending first apply).
+  pihole/USP secrets migrated to secretKeyRef in-cluster.
+- 2026-07-26: pihole surprise v5→v6 upgrade via `:latest` on a fresh node
+  pull; image pinned by digest, `FTLCONF_dns_listeningMode=ALL` +
+  `FTLCONF_webserver_api_password` (v6 ignores WEBPASSWORD), readiness probe
+  on :53 added. Gitea Actions pipeline + deployer RBAC added.