deploy: bump Knowledge for MCP image git fix

[Svaag]

Summary

• bump knowledge_mcp_version and knowledge_loop_version to fix: install git in Knowledge MCP image knowledge#25
• keeps the collector-backed canary settings from engineering-loop: ship loop traces to collector #315, but uses the image build fix needed for the git-based agent-core dependency

Why

The #315 production apply failed while building the Knowledge MCP image because uv sync needs git to resolve the pinned agent-core dependency inside the Docker build. AS215932/knowledge#25 installs git in the runtime image.

Validation

• pytest tests/iac/test_app_version_pins.py
• git diff --check
• cd ansible && ansible-playbook playbooks/engineering-loop.yml --syntax-check

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis ❌ 25 - Not compliant Non-compliant requirements: All six requirements are not addressed in this PR (firewall bogon management is untouched) 315 - Partially compliant Compliant requirements: Knowledge MCP and Knowledge Loop version pin updated to a commit that includes Make dom0 a proper Ansible role (currently bash-only via bootstrap-dom0.sh) #24 (collector-capable emission) plus firewall: codify /etc/pf.bogons6 in Ansible firewall role + remove ff00::/8 #25 (Docker git fix) Engineering Loop JSONL trace fallback and Knowledge Loop OpenRouter budget settings remain unchanged (still 0) Non-compliant requirements: Engineering-loop version pin not updated (remains at previous SHA, not bumped to vault-agent: stop noc-agent restart loop on JWT renewal + codify in role #26) No evidence that scripts/ci/render-all.sh, python3 unittest discover, scripts/ci/iac-static.sh, or yamllint were run in CI (only pytest tests/iac/test_app_version_pins.py and syntax check are mentioned) Requires further human verification: Actual live deployment and trace emission verification (whether the new image builds and collector accepts traces) cannot be confirmed via diff alone Validation scripts (render-all, unit tests, lint) need to pass on the final branch before merge

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 85

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.

[Svaag]

PR-agent ticket compliance notes:

• AS215932/knowledge#25 is a cross-repo PR reference, not network-operations issue firewall: codify /etc/pf.bogons6 in Ansible firewall role + remove ff00::/8 #25. This PR is intentionally unrelated to firewall bogon management.
• network-operations#315 is already merged; this is a narrow follow-up to repair its production apply failure by bumping Knowledge pins to the image-build fix. The engineering-loop pin was already set by engineering-loop: ship loop traces to collector #315 and remains intentionally unchanged.
• The final branch CI has now run the full repository gates for this PR: render, lint, semgrep, static-iac, ansible-idempotency, batfish, containerlab-frr, iac-gate, and Semgrep OSS are all green.

Local validation before opening: pytest tests/iac/test_app_version_pins.py, git diff --check, and cd ansible && ansible-playbook playbooks/engineering-loop.yml --syntax-check.

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 336f81048a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".