‘Stored program’ is where the debate is. Colossus was ‘programmable’ but the program was not a series of instructions executed in a sequence - it was a single data process executed on the input data against a set of stored registers.
Definitely programmable, definitely capable of computing, but not a ‘stored program’ in the sense we know it today.
Having seen the replica, I noticed it has a long continuous tape loop. Was the program "stored" in the paper tape?
That was the data. Point of Collosus was to analyze ciphertexts; the text goes on the loop. It’s looped so your program can run over the data multiple times, since it’s sequential access only.