chore(consul-postgres-ha): pin provider >= 0.2.0-beta.3, reframe hot-patch

terraform-provider-phala#8 fixed the env-block in-place-update bug
(phala-cloud#246) and shipped as v0.2.0-beta.3, so:

- cluster.tf required_providers now pins ">= 0.2.0-beta.3" with a
  comment explaining why earlier versions are unusable for this stack.
- PUBLISHING.md's hot-patch section reframes its motivation: the
  per-CVM hot-patch path remains useful as a dev shortcut and as the
  only option on clusters still running 0.2.0-beta.2, but it is no
  longer the workaround for env updates not landing — terraform apply
  works correctly now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h4x3rotab

consul-postgres-ha/stage4/PUBLISHING.md

@@ -87,11 +87,14 @@ real CI workflow.
 
 ## 3. Hot-patch on a live cluster — debugging without a redeploy
 
-Sometimes you need to swap a binary on a running CVM right now,
-without re-applying terraform (because `terraform-provider-phala` has
-a known bug where `env`-block in-place updates silently no-op — see
-`Phala-Network/phala-cloud#246` — and you don't want to recreate CVMs
-just to roll a new image).
+Sometimes you need to swap a binary on a running CVM right now —
+faster than re-running `terraform apply` (which propagates env updates
+correctly as of provider `0.2.0-beta.3`, but still goes per-CVM and
+takes a minute), useful for testing a fix on one CVM before rolling it
+cluster-wide, and the only option on clusters running the older
+`0.2.0-beta.2` provider where in-place env updates silently no-op'd
+(Phala-Network/phala-cloud#246; fixed by
+Phala-Network/terraform-provider-phala#8).
 
 ```bash
 GW=dstack-pha-prod5.phala.network

consul-postgres-ha/stage4/cluster-example/cluster.tf

@@ -14,8 +14,12 @@ terraform {
   required_version = ">= 1.5"
   required_providers {
     phala = {
-      source  = "phala-network/phala"
-      version = "0.2.0-beta.2"
+      source = "phala-network/phala"
+      # >= 0.2.0-beta.3 is required for in-place env-block updates to
+      # actually take effect — earlier versions silently no-op'd them
+      # (Phala-Network/phala-cloud#246, fixed in
+      # Phala-Network/terraform-provider-phala#8).
+      version = ">= 0.2.0-beta.3"
     }
   }
 }