Provider 2026.8.0 requires pbm_uuid on the applications API, which the
deployed authentik 2026.5.3 server does not return, so every
authentik_application read fails and no plan completes.
- Pin goauthentik/authentik to 2026.5.1, the newest release built on the
2026.5 API client
- Record 2026.5.1 in the lock file
- Drop -upgrade from make init so the lock is authoritative