Rotate every card URL past the corrupt ones

Fixing the rasterizer fixed the origin and changed nothing anyone had already
fetched. The version segment is a digest of the card's content, so a renderer
fix produces the identical URL, and the corrupt response was served with
`max-age=21600, immutable` -- which a browser will not revalidate and Slack
will not re-fetch. The site was correct and every reader still saw the break.

`template_revision` exists for exactly this and had never moved. Bumping it to
2 changes every card URL, so the next fetch is a miss everywhere at once
rather than a wait for six hours of TTL to drain.

The comment now says what the constant is for, because the failure was not
knowing there was a knob.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016o8HwTaqLKEWCHTjsjFtrB

Co-Authored-By

Claude Opus 5 (1M context) <noreply@anthropic.com>

Claude-Session

https://claude.ai/code/session_016o8HwTaqLKEWCHTjsjFtrB

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Changed files

• modified lib/openagents_web/og.ex

Diff

1 file changed, +7 -1

    :crypto.mac(:hmac, :sha256, secret, "openagents-og-cards-v1")

  end

  defp template_revision, do: "1"

  # Bump when the rendering changes, not only when a card's content does. The

  # version segment is a content digest, so a fix to the renderer produces the

  # same URL as the bug did -- and every cache holding the bad bytes, including

  # Slack's and a reader's browser, keeps serving them under a `max-age=21600,

  # immutable` response that will not revalidate. Revision 2 is the corrupt-PNG

  # fix: cards rendered before it carried librsvg's stderr ahead of the image.

  defp template_revision, do: "2"

  defp base_url, do: String.trim_trailing(OpenAgentsWeb.Endpoint.url(), "/")