fix(immich): detect new image on pull and restart service

'Writing manifest' is printed by podman pull on stderr (not stdout), so
changed_when never matched, the Restart Immich handler never fired, and
pods kept running the old image after upgrades. Matching on stderr would
be wrong too: podman prints that line even when the image is unchanged.

Compare the local image ID before/after pull instead, and notify the
restart handler only when the tag resolves to a new image.

roles/immich/tasks/main.yml

@@ -98,16 +98,29 @@
   loop:
     - "{{ immich_upload_location }}"
 
-- name: Pull Immich container images
+# yamllint disable-line - the format template must not be expanded by Jinja
-  ansible.builtin.command: "podman pull {{ item }}"
+- name: Get current Immich image IDs
+  ansible.builtin.command: "podman image inspect --format {% raw %}{{.Id}}{% endraw %} {{ item }}"
   loop:
     - "{{ immich_server_image }}:{{ immich_version }}"
     - "{{ immich_ml_image }}:{{ immich_version }}"
-  changed_when: pull_result.stdout is search('Writing manifest')
+  register: immich_image_ids_before
-  register: pull_result
+  failed_when: false # image may not exist yet on first deploy
+  changed_when: false
   become: false
   become_user: "{{ ansible_user }}"
 
+- name: Pull Immich container images
+  ansible.builtin.command: "podman pull --quiet {{ item.item }}"
+  loop: "{{ immich_image_ids_before.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  register: pull_result
+  changed_when: pull_result.stdout != item.stdout
+  become: false
+  become_user: "{{ ansible_user }}"
+  notify: Restart Immich
+
 - name: Deploy Kubernetes YAML for Immich
   ansible.builtin.template:
     src: immich.yaml.j2