Release 2.1.157 (2026-07-23)

Bug fixes

• make repo's [ci].versions authoritative for local container selection (#2469) vrg-container-run picked the dev/validate container version from a hardcoded _DEFAULT_VERSIONS constant and ignored the consuming repo's declared vergil.toml [ci].versions. A tooling-side bump of that constant (3.12 -> 3.14) therefore silently switched every repo's local builds to a different interpreter — no repo change, no release, no opt-in — and skewed local from CI (which runs [ci].versions). On 3.14 that surfaced as the intermittent ansible-lint crash, costing a consuming repo days of red-herring debugging.

Make the repo's declared version authoritative: - New config.primary_ci_version(repo_root) returns [ci].versions[0], or None when there is no vergil.toml (a malformed config still fails loudly via ConfigError, matching validation_container_command / container_env_prefixes). - default_image() gains a version override; callers pass the declared primary so the repo, not a constant, picks the prod-: tag. _DEFAULT_VERSIONS is used only when the repo declares none. - All container-selection call sites thread it: vrg-container-run, provision_dev_image (finalize), vrg-container-test, vrg-container-cache. - vrg-container-run warns loudly when it falls back to the built-in default, so a future default bump can never again silently reintroduce local/CI skew.

CI Evidence: All gates passed — full audit bundle available. Download →