fix(ci): stop pinning Camunda 8.8 test image to floating 8.10-SNAPSHOT

[claude]

Requested via Slack thread

Before / After

Before: assets/c8/8.8/docker-compose.yml hardcoded image: camunda/camunda:8.10-SNAPSHOT for the "Camunda 8.8" integration test leg. That meant the leg named "8.8" was actually running against a completely unrelated, constantly-moving 8.10 snapshot build instead of any real 8.8 release.

After: the image is parameterized as image: camunda/camunda:${CAMUNDA_VERSION}, exactly matching the pattern already used in assets/c8/8.9/docker-compose.yml. A CAMUNDA_VERSION=8.8.36 default was added to assets/c8/8.8/.env (mirroring CAMUNDA_VERSION=8.9.1 in assets/c8/8.9/.env) so docker compose up still resolves to a real, pinned 8.8.x image by default, while CI's env: CAMUNDA_VERSION: ${{ matrix.camunda }} step can still override it per the test matrix.

In short: the "Camunda 8.8" test leg was silently running against a moving 8.10-SNAPSHOT image instead of a real 8.8 image; now it correctly runs against ${CAMUNDA_VERSION}, matching the 8.9 leg's pattern.

Why

Because the tag is now a variable rather than a literal Docker tag, Renovate's docker-compose manager has nothing to bump here anymore — the same protection that has kept assets/c8/8.9/docker-compose.yml untouched by Renovate all along. No renovate.json changes were needed for this.

How

Release run 32697338313 failed because the "Camunda 8.8" integration-test leg was actually exercising camunda/camunda:8.10-SNAPSHOT. That pin was introduced by Renovate PR #500 (commit 1b18719, "chore(deps): update camunda/camunda docker tag to v8.10"), which mistakenly bumped what was meant to be a fixed 8.8-SNAPSHOT compatibility-test pin — Renovate saw a literal, bumpable Docker tag and updated it like any other dependency. Since that merge, the "8.8" leg has been silently running against 8.10-SNAPSHOT, and an upstream change to that snapshot broke compatibility, failing the leg and skipping the whole release.

This PR parameterizes the image the same way 8.9's compose file already does, restoring an actual 8.8 test target and removing the accidental Renovate bump surface going forward.

Verified locally: docker compose config in assets/c8/8.8 resolves image: camunda/camunda:8.8.36 by default, and CAMUNDA_VERSION=8.8 docker compose config resolves image: camunda/camunda:8.8 (matching the CI matrix override), analogous to assets/c8/8.9's existing behavior.

---

Generated by Claude Code

---

Update: while this PR was open (and still in draft), Renovate opened and merged PR #543, bumping the camunda/camunda docker tag on main from 8.10-SNAPSHOT to 8.11-SNAPSHOT — the exact same kind of accidental bump of a fixed test-matrix pin that PR #500 caused originally, this time hitting the merge-conflict-resolved version of this branch instead of a merged tag. That's the second time Renovate has auto-bumped this pin.

Parameterizing the image as ${CAMUNDA_VERSION} (this PR's main change) removes the literal Docker tag Renovate's docker-compose manager was bumping, but CAMUNDA_VERSION is still a literal version string in assets/c8/8.8/.env and assets/c8/8.9/.env, which could plausibly become the next attack surface for an auto-bump. As defensive insurance, this PR now also adds a packageRules entry to .github/renovate.json disabling Renovate updates for assets/c8/8.8/** and assets/c8/8.9/**, so this pin can't be silently moved again by any current or future Renovate manager.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}