Release 2026.9.22, and pin the cargo-chef base image

The version macro drives the release tag and what the server reports. The
builder's base image was the one image reference still floating on a tag.

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM docker.io/lukemathwalker/cargo-chef:latest-rust-slim-trixie AS chef
+FROM --platform=$BUILDPLATFORM docker.io/lukemathwalker/cargo-chef:latest-rust-slim-trixie@sha256:38dfdbf4fda95c516f873f33032e490baa988b75f7d83c7d12f788f770785b36 AS chef
 WORKDIR /build
 
 FROM --platform=$BUILDPLATFORM chef AS planner

crates/types/src/branding.rs

@@ -71,7 +71,7 @@ pub fn env_var(name: &str) -> Result<String, std::env::VarError> {
 #[macro_export]
 macro_rules! brand_version {
     () => {
-        "2026.9.20"
+        "2026.9.22"
     };
 }