chore: update Dockerfile pinned versions

[github-actions]

Dependency Version Updates

This PR updates pinned versions in the Dockerfile and synchronizes release documentation:

• COMPOSE_VERSION: 5.3.0 → 5.3.1 (source: docker/compose)
• OPENCODE_VERSION: 1.17.14 → 1.17.15 (source: opencode-ai)
• GLAB_VERSION: 1.106.0 → 1.107.0 (source: gitlab-org/cli)

Documentation Updates

• README badges synchronized with pinned package versions
• CHANGELOG entry prepared for the next patch release

Test Results

Integration tests passed on the updated image.

Security Scan Results

No new critical Grype findings were introduced relative to the latest published release image.

Latest Package Changes

[]

APT Updates

All packages are up to date

---

Generated automatically by the Dependency Update workflow

[tryweb]

🤖 Automated PR Triage — Holding for manual review

Decision: NOT auto-merging this PR.

CI status

Check	Status	Run
CI (pull_request)	⚠️ action_required	#28910143078
CI (workflow_dispatch)	❌ failure	#28910144775

Failing job: Build Image → Build image step (Dockerfile:135)

#19 [13/30] RUN curl -fsSL https://leanctx.com/install.sh | sh
#19 0.928 Fetching latest release...
#19 1.037 curl: (22) The requested URL returned error: 403
#19 1.039 Error: could not determine latest release.

The lean-ctx installer cannot reach https://api.github.com/repos/yvgude/lean-ctx/releases/latest (HTTP 403). This is almost certainly GitHub API anonymous rate-limiting from inside the buildx container — the call is unauthenticated, so the build is sharing the runner's IP-based quota.

Why this isn't a problem with the PR

The PR diff is purely version bumps — no code change touches the lean-ctx install step:

• Dockerfile: +3 / −3 (COMPOSE 5.3.0→5.3.1, OPENCODE 1.17.14→1.17.15, GLAB 1.106.0→1.107.0)
• README.md: OpenCode badge bump
• docs/CHANGELOG.md: changelog entry
• test-output.txt: OpenCode version string in test artifact

Line 135 (RUN curl -fsSL https://leanctx.com/install.sh | sh) is identical to main and the latest successful main CI run was 2026-07-07 03:49 UTC. The 403 is infrastructure flake, not a regression in this PR.

Action items

1. Tracking issue opened: lean-ctx install path needs to be hardened against GitHub API rate-limiting (use a GITHUB_TOKEN build-arg, or pin to a specific release tag).
2. Once the Dockerfile is patched and CI goes green, this PR can be re-evaluated — its content is otherwise safe to merge.
3. @maintainers — please confirm the assessment above and either (a) push a follow-up commit hardening the lean-ctx install step, or (b) re-run CI after rate-limit window resets.

---

Automated triage per the dependency-update safety policy: CI must be fully green before auto-merge.

[tryweb]

Tracking issue: #45

[tryweb]

Approved via automated dependency-update triage.

Verification summary (2026-07-08):

• Dependency-update workflow run 28929122630 (workflow_dispatch, 2026-07-08 08:34 UTC) completed successfully.
• This PR was generated by that run and rebased onto main (which contains fix e0ba3cc for the lean-ctx install path).
• CI dispatch run 28929885450 at HEAD SHA 7a5ba63:
  • Build Image: success
  • Integration Tests: success
  • Vulnerability Scan: success (no new critical findings vs baseline)
• Diff is limited to Dockerfile version ARGs, README badge, CHANGELOG entry, and test artifact.
• No breaking changes (Docker Compose 5.3.1 release notes are internal-only).
• Patch (Compose 5.3.0→5.3.1, OpenCode 1.17.14→1.17.15) + minor (glab 1.106.0→1.107.0) version bumps only.

Safe to squash-merge per the dependency-update safety policy.