docs: fix registry-and-build.md drift (host count, stack count, holdouts)

Same music-assistant strategy change fixed in the KB earlier this
session (dockerfile -> pinned_manual, avoiding auto-update-triggered
audio-analysis invalidation): stack count corrected 36->35, added to
the Deliberate Holdouts table with its own real reason. Also found a
second gap: 'All 5 Docker hosts converted' should be 6 - NetBird now
has its own dockerfile-strategy stack (hawser), confirmed live in its
docker_stacks.yml, and was missing from this count.

docs/registry-and-build.md

@@ -1,6 +1,6 @@
-<!-- verified: 2026-09-06
-     ansible@ccbda37 : host_vars/rocky-docker/docker_stacks.yml, roles/container_update, playbooks/container_update.yml
-     iac@49ff427 : ansible/roles/secure_vault/vault_agent/defaults/main.yml
+<!-- verified: 2026-09-19
+     ansible@24e1bf0 : host_vars/rocky-docker/docker_stacks.yml, host_vars/netbird/docker_stacks.yml, roles/container_update, playbooks/container_update.yml
+     iac@f770e1c : ansible/roles/secure_vault/vault_agent/defaults/main.yml
      trilium : dcRUArk5dWH8, bW84ccRoAJ5i, hWiIGZIlvQiN
 -->
 
@@ -13,7 +13,7 @@
 |---|---|
 | **Registry** | Gitea's own built-in container registry |
 | **Trigger** | Weekly schedule via Kestra, not push-triggered |
-| **Rollout** | All 5 Docker hosts converted; the largest has 36 of 41 stacks on this pattern |
+| **Rollout** | All 6 Docker hosts converted; the largest has 35 of 41 stacks on this pattern |
 
 ## Why Self-host The Registry Instead Of Just Using Docker Hub
 
@@ -39,14 +39,15 @@ Not every stack is on this pattern, and that's a decision, not an oversight —
 ```
 $ python3 -c "import yaml; d=yaml.safe_load(open('docker_stacks.yml'))['stacks']; ..."
 total: 41
-dockerfile     36
-pinned_manual   3
+dockerfile     35
+pinned_manual   4
 latest          2
 ```
 
 | Stack | Why it's held out |
 |---|---|
 | Authentik, Immich, tdarr | Complex multi-service upstream builds — not worth replicating a build process the upstream project already maintains well; the maintenance cost of tracking their own build changes would exceed the benefit |
+| Music-assistant | Was on this pattern, deliberately reverted — auto-updating `:latest` kept bumping its `smart_fades`/`loudness_analysis` `analysis_version`, mass-invalidating ~86k tracks' audio-analysis backlog each time it moved; now pinned by hand, bumped only after checking release notes |
 | Kodi's own app image | Genuinely still a direct Docker Hub dependency — low enough stakes that the extra build step isn't worth it |
 | Nextcloud's own `nextcloud`/`euro-office` services | Pre-existing custom Dockerfiles, left as-is beyond adding `image:` references — its own db/redis still float on Docker Hub tags directly, a conscious "don't touch what already works" call |