DKIM signing happens on the sending mail server, i.e. after Discourse has given it to the SMTP server it’s configured to use.
If you’re seeing a hash mismatch, that suggests either the email has been modified after being signed or the key pair doesn’t match.
If you’re definitely using identical details in Thunderbird and Discourse (have you restarted the container to make sure it’s using the details you have in app.yml?), I would be surprised if it’s getting signed with a different key or using a different selector so I would expect to see the same result if the key pair didn’t match.
Could it be that the from address differs and your mail provider is signing differently based on that?
Essentially, something is happening after it’s left Discourse. If you can’t find an obvious cause like the from address, you might need to contact your mail provider to find out what’s happening.