searxng: new chart (1.0.0+up2026.8.22.9fea41204)

SearXNG as a stateless Deployment plus a settings ConfigMap, with the four CI
steps a new chart needs: publish workflow, change-app-version choice list,
ci/searxng/ fixtures and a renovate.json5 block.

Three points where the chart is not a cyberchef with another name:

* The image entrypoint writes settings.yml into /etc/searxng only when the
  file is missing. The chart always mounts one by subPath, so the copy and
  the random-secret sed never run and the container needs no write access
  there - which is what allows readOnlyRootFilesystem: true.
* The signing key is a required OnePasswordItem, not a ConfigMap key. It
  signs the settings cookie and the image-proxy URLs, and the entrypoint's
  self-generating fallback cannot fire here, so without it the instance would
  run on the literal "ultrasecretkey" - which webapp.py refuses with exit 1.
* All three probes use /healthz, the only path the bot detection lets through
  unconditionally. Measured: with the limiter active, "/" answers 429 while
  /healthz still answers 200.

ingress.domain is read a second time outside the Ingress template, for
SEARXNG_BASE_URL, and carries its own required() there - so it stays
mandatory with the Ingress switched off.

The Renovate versioning regex deviates from the plan on the issue and matches
the commit hash WITHOUT capturing it. Renovate parses a "build" group with
Number.parseInt, so a hash becomes the digits leading it; measured on
renovate 41.173.1 and 44.48.0, the planned form reports an image pushed
earlier the same day as an update to a newer one. Reasoning in the block and
in README.

ci/searxng/fixtures.yaml

@@ -0,0 +1,15 @@
+# Fixtures for the searxng install-test: the one Secret the 1Password operator
+# would otherwise materialize (release name: ci).
+#
+# The value is a throwaway string, and this chart genuinely needs nothing more
+# than that - unlike freesailarr, whose fixtures need a real credential to get
+# past a VPN handshake. What it does need is a value that is NOT the upstream
+# placeholder "ultrasecretkey": SearXNG's webapp.py init() exits 1 on that, so
+# an empty or careless fixture would produce a crash loop rather than a
+# passing install-test.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ci-searxng-secret
+stringData:
+  secret-key: searxng-ci-secret-key-0123456789abcdef0123456789abcdef

ci/searxng/test-values.yaml

@@ -0,0 +1,32 @@
+# searxng: stateless, one secret and no infrastructure to stand up. The
+# Ingress just has to apply - there is no ingress-nginx/cert-manager in the CI
+# cluster.
+#
+# The install runs the DEFAULT path (bot detection off, no Valkey), which is
+# what a real installation of this chart runs. The optional Valkey branch is
+# rendered but not installed here: switching the limiter on without a reachable
+# Valkey produces a Ready pod that logs an error per request, so it would make
+# the install-test slower without making it stricter.
+ingress:
+  domain: searxng.ci.local
+  clusterIssuer: ci
+
+# The dummy 1Password Secret is created in fixtures.yaml; the operator does not
+# run in CI, so the OnePasswordItem CR stays unfulfilled and only the stub CRD
+# has to accept it.
+secrets:
+  searxngSecretRef: op://ci/searxng/dummy
+
+# Deliberately not the chart defaults. The install-test is the only place that
+# proves the ConfigMap is more than a fixed file: instanceName exercises the
+# first-class keys, and "extra" exercises the merge over them - including a
+# nested map that has to be joined rather than replaced (search.safe_search
+# from above must survive next to search.default_lang from here).
+settings:
+  instanceName: "SearXNG CI"
+  safeSearch: 1
+  extra:
+    search:
+      default_lang: "en"
+    ui:
+      default_theme: simple