These five were added to .env.sample while abra.sh already exported them, so every
deployment got a second, divergent copy.
That is not just untidy. .env.sample becomes the operator .env at `abra app new`,
and a .env is NEVER updated by a recipe upgrade. So the next time a recipe change
bumps e.g. CLICKHOUSE_ENTRYPOINT_VERSION in abra.sh, an existing deployment keeps
the stale value from its .env: the config CONTENT changes while the swarm config
NAME does not, and swarm configs are immutable -
FATA failed to update config <stack>_clickhouse_entrypoint_v6:
only updates to Labels are allowed
which is exactly the failure gitea hit with app_ini_v22.
The fleet convention, consistent across gitea/discourse/keycloak/mailu: .env.sample
carries SECRET_*_VERSION only (operator-managed secret rotation); config object
versions live in abra.sh (recipe-managed - bumping one IS a recipe change).
plausible main already followed this; only this branch diverged.
abra.sh is unchanged and keeps CLICKHOUSE_USER_CONF_VERSION=v3 - that bump is
correct, clickhouse-user-config.xml content genuinely changed.
