fix: pin versions for all repair software packages

tasks/install-repair-tools.yml

@@ -59,7 +59,16 @@
     owner: "root"
     group: "root"
     mode: "750"
-  loop: "{{ tool_versions }}"
+  loop: "{{ tool_versions_local }}"
+
+- name: configure tool version pinning to avoid automatic nightly upgrades
+  ansible.builtin.template:
+    src: "etc/apt/preferences.d/pinning.j2"
+    dest: "/etc/apt/preferences.d/{{ item.package_name }}"
+    owner: "root"
+    group: "root"
+    mode: "750"
+  loop: "{{ tool_versions_public }}"
 
 # FHS 3.0 specifies the correct path for the config:
 # https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s09.html