fix(searxng-docker): pin image and fix Valkey capability drop

[mshahid538]

Summary

• Bump SearXNG image pin to docker.io/searxng/searxng:2026.8.10-0a118066d in static docker-compose.yaml and copier default (prior 2026.5.13-eb12c9b 404s on Docker Hub; copier was still on 2024.12.16).
• Remove cap_drop: ALL from the Valkey/redis service — Valkey's entrypoint uses setpriv/setresuid and exits 127 under a full capability drop (verified on the Labs droplet deploy).
• Record the fix under root CHANGELOG.md [Unreleased].

Decisions

• Keep security_opt: no-new-privileges:true on Valkey; only drop the broken cap_drop: ALL.
• Sync copier searxng_image default with the static compose pin per the in-file comment.

Test plan

• docker compose pull succeeds with the new image tag on the Labs SearXNG droplet
• Valkey container reaches healthy after removing cap_drop: ALL
• https://searxng.weown.tools/search?q=test&format=json returns 200 with results
• CI validation / gitleaks / branch-name checks green on this PR
• Address Copilot review comments before merge

Not-in-scope

• Decommission of legacy searxng.weown.app (separate DO account / DNS)
• Infisical ADR-006 cutover for the static compose path
• Cloudflare DNS / firewall changes

[Copilot]

Pull request overview

This PR updates the searxng-docker Docker Compose deployment to use a currently-available, date-tagged SearXNG image and adjusts Valkey hardening so the container can start successfully, with the change recorded in the repo-level changelog.

Changes:

• Pin SearXNG to docker.io/searxng/searxng:2026.8.10-0a118066d in the static compose file.
• Sync the copier default searxng_image to the same pinned tag.
• Remove cap_drop: ALL from the Valkey service and document why; add a root CHANGELOG.md entry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
searxng-docker/docker-compose.yaml	Pins the SearXNG image tag and removes Valkey cap_drop: ALL with rationale.
searxng-docker/copier.yaml	Updates the copier template default to match the new SearXNG image pin.
CHANGELOG.md	Records the searxng-docker pin + Valkey change under [Unreleased].

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

searxng-docker/docker-compose.yaml:7

• The comment references .github/copilot-instructions.md §3.7 (Kubernetes) and a non-existent searxng-docker/template/copier.yaml. This can mislead future bumps; the pinned-image guidance is in §3.8 and the copier defaults live in searxng-docker/copier.yaml.

    # Pinned per .github/copilot-instructions.md §3.7 (immutable tags).
    # SearXNG publishes dated tags — see https://hub.docker.com/r/searxng/searxng/tags
    # When bumping, also update the canonical template at
    # searxng-docker/template/copier.yaml's `searxng_image` default.

[mshahid538]

Addressed Copilot's suppressed note on the image-pin comment: corrected §3.7→§3.8 and \searxng-docker/template/copier.yaml\ → \searxng-docker/copier.yaml.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[mshahid538]

Also landed the missing WEOWN_BOT_PAT live-probe (from the buzz branch) so create-pr skips green on a present-but-expired token instead of failing checkout.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

searxng-docker/docker-compose.yaml:4

• The comment says “immutable tags”, but this compose file is pinned to a Docker tag (not a digest). To avoid confusion with the repo’s guidance (digest preferred, tags acceptable), reword this to explicitly say it’s pinned to a non-floating tag and that digests are preferred when practical.

    # Pinned per .github/copilot-instructions.md §3.8 (immutable tags).

.github/workflows/auto-pr-to-main.yml:98

• This gate step passes the PAT as part of the curl command line (Authorization header), which places the secret on the process argv. Since this workflow already depends on the GitHub CLI, use gh api with GH_TOKEN instead so the token stays in the environment rather than argv.

          # Present-but-dead PAT must not fail checkout (red on every push).
          # Probe without printing the token; treat non-200 as "not applicable".
          http_code="$(curl -sS -o /dev/null -w '%{http_code}' \
            -H "Authorization: Bearer ${WEOWN_BOT_PAT}" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/user || true)"