Deploy ihasmail's newest release, recorded by its dated tag

The ihasmail default was a pin that went stale within days, and ihasmail
keeps ten releases' images, so an old default would in time stop pulling.
With no --ihasmail-image the tool now pulls :latest before asking, reads the
version the image carries, confirms the dated tag is the same image, and
writes that tag into compose.yaml (or the digest, if there is no such tag).
Stalwart and Caddy stay pinned. A weekly end-to-end run against the newest
release, three hours after ihasmail publishes, is what keeps it safe.

internal/render/templates/compose.yaml.tmpl

@@ -31,6 +31,8 @@ services:
         ipv4_address: {{.Plan.StalwartIP}}
 
   ihasmail:
+    # A fixed release: `docker compose pull` never moves it. To upgrade, change
+    # the tag here, then `docker compose pull && docker compose up -d`.
     image: {{.Plan.IhasmailImage}}
     restart: unless-stopped
     depends_on: [stalwart]