Script to sync Dockerfile and mise.toml

AGENTS.md

@@ -26,11 +26,23 @@ firehose/
 │   ├── lib/
 │   └── mix.exs
 ├── mise.toml               # Runtime versions (Elixir, Erlang, Node)
+├── Dockerfile              # Deploy build; ARG pins must match mise.toml
+├── scripts/check-pins.sh   # Verifies the pin sync; runs in `make check`
 └── Makefile                # make (test, check) 
 ```
 
 Two blogs are configured:
 
+# Toolchain pins
+
+`mise.toml` and the `Dockerfile` ARG pins must agree; `scripts/check-pins.sh`
+(runs as part of `make check`) enforces this. When bumping versions, change
+both files in one commit. Upstream drift (newer Elixir/OTP/Debian releases)
+is reported by `dokku-updates firehose check` (dokku-maintenance repo).
+Upgrading pins or mix packages is largely unscripted: for such tasks, a Pi
+sub agent can be started in this directory — it reads this AGENTS.md and
+follows the zero-defects policy above.
+
 | Blog | Route | Description |
 |------|-------|-------------|
 | Engineering | `/blog/engineering` | Main blog |