sol v1.1.0: SearXNG web search, evaluator redesign, research agents

- SearXNG deployment in data namespace (free, no-tracking web search)
- sol-config: SearXNG URL, research config, identity agent, updated
  system prompt (DM search rules, research mode, silence, hard rules)
- sol-deployment: debug logging (RUST_LOG=sol=debug), full image path
- opensearch: tolerate missing prometheus-exporter plugin on OS 3

base/data/kustomization.yaml

@@ -13,6 +13,11 @@ resources:
   - opensearch-pvc.yaml
   - openbao-keys-placeholder.yaml
   - barman-vault-secret.yaml
+  - opensearch-servicemonitor.yaml
+  - opensearch-alertrules.yaml
+  - postgres-alertrules.yaml
+  - openbao-alertrules.yaml
+  - searxng-deployment.yaml
 
 helmCharts:
   # helm repo add cnpg https://cloudnative-pg.github.io/charts

base/data/opensearch-deployment.yaml

@@ -24,6 +24,8 @@ spec:
       containers:
         - name: opensearch
           image: opensearchproject/opensearch:3
+          command: ["sh", "-c"]
+          args: ["opensearch-plugin install --batch prometheus-exporter || true; /usr/share/opensearch/opensearch-docker-entrypoint.sh"]
           ports:
             - name: http
               containerPort: 9200

base/data/searxng-deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: searxng-config
+  namespace: data
+data:
+  settings.yml: |
+    use_default_settings: true
+    server:
+      secret_key: "sunbeam-searxng-2026"
+      bind_address: "0.0.0.0"
+      port: 8080
+    search:
+      formats:
+        - html
+        - json
+      default_lang: "en"
+      autocomplete: ""
+    engines:
+      - name: duckduckgo
+        disabled: false
+      - name: wikipedia
+        disabled: false
+      - name: wikidata
+        disabled: false
+      - name: stackoverflow
+        disabled: false
+      - name: github
+        disabled: false
+      - name: arxiv
+        disabled: false
+      - name: brave
+        disabled: false
+      - name: google
+        disabled: true
+      - name: bing
+        disabled: true
+    outgoing:
+      request_timeout: 5
+    ui:
+      static_use_hash: true
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: searxng
+  namespace: data
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: searxng
+  template:
+    metadata:
+      labels:
+        app: searxng
+    spec:
+      containers:
+        - name: searxng
+          image: searxng/searxng:latest
+          ports:
+            - containerPort: 8080
+          volumeMounts:
+            - name: config
+              mountPath: /etc/searxng/settings.yml
+              subPath: settings.yml
+          resources:
+            limits:
+              memory: 4Gi
+            requests:
+              memory: 512Mi
+              cpu: 100m
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      volumes:
+        - name: config
+          configMap:
+            name: searxng-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: searxng
+  namespace: data
+spec:
+  selector:
+    app: searxng
+  ports:
+    - port: 8080
+      targetPort: 8080