Document version tracking convention in review-services

Container image tags are decoupled from upstream app versions;
service-versions.yaml tracks the upstream app version.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/how-to/knowledgebase/review-services.md

@@ -1,6 +1,6 @@
 ---
 title: Review Services
-modified: 2026-02-16
+modified: 2026-02-19
 tags:
   - how-to
   - maintenance
@@ -62,6 +62,10 @@ Same as ArgoCD, but also check for new chart versions in the mirrored chart repo
 3. If upgrading, update the version and dry-run: `mise run provision-indri -- --tags <service> --check --diff`
 4. Follow [[add-ansible-role]] patterns for role changes
 
+## Version Tracking Convention
+
+The `current-version` field in `service-versions.yaml` tracks the **upstream application version**, not the container image tag. For hybrid services, the container image tag (e.g., `v1.0.0`) is decoupled from the contained app version (e.g., `v1.10.1`). This allows container rebuilds (base image updates, build fixes) without implying an upstream version change.
+
 ## Marking a Service as Reviewed
 
 After reviewing, edit `service-versions.yaml` (repo root) and update the service entry: