diff --git a/.woodpecker/alert-monitor.yml b/.woodpecker/alert-monitor.yml
index c7db120f..4507eb21 100644
--- a/.woodpecker/alert-monitor.yml
+++ b/.woodpecker/alert-monitor.yml
@@ -101,7 +101,7 @@ steps:
         bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: alert-triage-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token
diff --git a/.woodpecker/ci-scripts-test.yml b/.woodpecker/ci-scripts-test.yml
index d026422e..27feb22e 100644
--- a/.woodpecker/ci-scripts-test.yml
+++ b/.woodpecker/ci-scripts-test.yml
@@ -35,18 +35,18 @@ when:
 steps:
   - name: model-selection-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     commands:
       - sh scripts/ci/test-model-selection.sh
 
   - name: promtool-rules-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     commands:
       - sh scripts/ci/test-promtool-rules.sh
 
   - name: yaml-citations-guard-tests
     depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     commands:
       - sh scripts/ci/test-yaml-citations.sh
diff --git a/.woodpecker/e2e.yml b/.woodpecker/e2e.yml
index e5bb40ed..0e2f37d1 100644
--- a/.woodpecker/e2e.yml
+++ b/.woodpecker/e2e.yml
@@ -26,7 +26,7 @@ steps:
     # fetch-models.sh response mapping. No cluster, no secrets, no network — the
     # ci-claude image just provides sh + jq. Keeps the flag-injection regression
     # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     commands:
       - sh scripts/ci/test-model-selection.sh
 
diff --git a/.woodpecker/issue-fix.yml b/.woodpecker/issue-fix.yml
index 62fc3600..caab1fa2 100644
--- a/.woodpecker/issue-fix.yml
+++ b/.woodpecker/issue-fix.yml
@@ -62,7 +62,7 @@ steps:
       - bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: issue-fix-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token
diff --git a/.woodpecker/pr-review.yml b/.woodpecker/pr-review.yml
index 363e7090..5e8afc92 100644
--- a/.woodpecker/pr-review.yml
+++ b/.woodpecker/pr-review.yml
@@ -65,7 +65,7 @@ when:
 
 steps:
   - name: pr-review-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token
diff --git a/.woodpecker/security-scan.yml b/.woodpecker/security-scan.yml
index 172a4a93..3dd129fe 100644
--- a/.woodpecker/security-scan.yml
+++ b/.woodpecker/security-scan.yml
@@ -70,7 +70,7 @@ steps:
     # this step is skipped — otherwise we'd fork-bomb PRs.
     when:
       - branch: master
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token
diff --git a/.woodpecker/update-audit.yml b/.woodpecker/update-audit.yml
index 67129f05..c3fe9152 100644
--- a/.woodpecker/update-audit.yml
+++ b/.woodpecker/update-audit.yml
@@ -30,7 +30,7 @@ when:
 
 steps:
   - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
         from_secret: claude_code_oauth_token
diff --git a/.woodpecker/wiki-maintenance.yml b/.woodpecker/wiki-maintenance.yml
index 6634135a..c05124fe 100644
--- a/.woodpecker/wiki-maintenance.yml
+++ b/.woodpecker/wiki-maintenance.yml
@@ -17,7 +17,7 @@ when:
 
 steps:
   - name: checkout-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     pull: true
     environment:
       WIKI_BOT_TOKEN:
@@ -54,7 +54,7 @@ steps:
       - bash scripts/ci/make-diag-kubeconfig.sh
 
   - name: distill
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     pull: true
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
@@ -89,14 +89,14 @@ steps:
           -p
 
   - name: audit
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     pull: true
     commands:
       # Findings are report lines in output/, not a pipeline failure.
       - python3 -B notes/bin/wiki_audit.py --vault "$$PWD/notes"
 
   - name: consolidate
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     pull: true
     environment:
       CLAUDE_CODE_OAUTH_TOKEN:
@@ -145,7 +145,7 @@ steps:
         exit $$rc
 
   - name: push-notes
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.280
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.283
     pull: true
     environment:
       WIKI_BOT_TOKEN: