fix(security): refresh client trust and adopt corrected upstream SearXNG (#6791)

Select the official immutable SearXNG release with corrected system and certifi stores in all Compose deployments. Retain native offline, actual-entrypoint and Compose/live regression checks while removing the custom trust-repair image and registry publication path. Reuse the canonical CA inventory checker.

Include released Python, certifi, grpcio, uv and Docker CLI trust updates and strict fourteen-chain validation. Keep unreleased CPython verifier and native-helper fixes separate from claims about shipped artifacts.

Part of #6784 and #6790.

Co-authored-by: Léo <leograndcontact@gmail.com>

tests/test_ca_trust.py

@@ -132,7 +132,7 @@ class CATrustTests(unittest.TestCase):
             custom = directory / "custom.pem"
             fingerprint = next(iter(INCIDENT["intermediates"]))
             custom.write_text(clean.read_text() + INCIDENT["certificates"][fingerprint])
-            self.assertEqual(len(INCIDENT["chains"]), 12)
+            self.assertEqual(len(INCIDENT["chains"]), 14)
             custom_accepted = []
             for hostname, chain in INCIDENT["chains"].items():
                 leaf, intermediates = directory / "leaf.pem", directory / "chain.pem"
@@ -156,9 +156,11 @@ class CATrustTests(unittest.TestCase):
                     self.assertIn("unable to get local issuer certificate", negative.stderr)
                     if verify(custom).returncode == 0:
                         custom_accepted.append(hostname)
-            self.assertEqual(custom_accepted, [
+            self.assertCountEqual(custom_accepted, [
                 "dv-g3b-aaa-emudhra.we-have-a-problem.com",
+                "dv-g3b-aaa-noct-emudhra.we-have-a-problem.com",
                 "dv-g3b-emudhra.we-have-a-problem.com",
+                "dv-g3b-noct-emudhra.we-have-a-problem.com",
             ])
             checker.check_bundle(clean)
             for bundle in (affected, custom):