Bump service images and update Tempo config

Update Woodpecker, Gitea, Herald, and observability stack
images to latest versions. Migrate Tempo config to v3
schema with live_store and backend_scheduler/worker.
Add Docker socket mount and sandbox iteration limit to
Herald, and switch its model and entrypoint.

docker-compose.core.yml

@@ -20,7 +20,7 @@ services:
             - prometheus_network
 
     woodpecker_server:
-        image: woodpeckerci/woodpecker-server:v3.17-alpine
+        image: woodpeckerci/woodpecker-server:v3.18.1-alpine
         volumes:
             - woodpeckerdata:/var/lib/woodpecker/
         entrypoint: /bin/sh -c "export WOODPECKER_GITEA_CLIENT=$$(cat /run/secrets/woodpecker_gitea_client) && export WOODPECKER_GITEA_SECRET=$$(cat /run/secrets/woodpecker_gitea_secret) && export WOODPECKER_AGENT_SECRET=$$(cat /run/secrets/woodpecker_agent_secret) && /bin/woodpecker-server"
@@ -37,7 +37,7 @@ services:
             - woodpecker_gitea_secret
 
     woodpecker_agent:
-        image: woodpeckerci/woodpecker-agent:v3.17-alpine
+        image: woodpeckerci/woodpecker-agent:v3.18.1-alpine
         volumes:
             - /var/run/docker.sock:/var/run/docker.sock
         entrypoint: /bin/sh -c "export WOODPECKER_AGENT_SECRET=$$(cat /run/secrets/woodpecker_agent_secret) && /bin/woodpecker-agent"
@@ -51,7 +51,7 @@ services:
             - woodpecker_agent_secret
 
     gitea:
-        image: docker.gitea.com/gitea:1.27.1
+        image: docker.gitea.com/gitea:1.27.3
         environment:
             - USER_UID=1000
             - USER_GID=1000
@@ -64,7 +64,9 @@ services:
             - reverse_network
 
     herald:
-        image: tintounn/herald:1.1
+        image: tintounn/herald:1.2
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock
         entrypoint:
             - /bin/sh
             - -c
@@ -73,7 +75,7 @@ services:
                 export OPEN_ROUTER_API_KEY=$$(cat /run/secrets/herald_openrouter_token) &&
                 export WEBHOOK_SIG_HEADER_SECRET=$$(cat /run/secrets/herald_gitea_header_secret) &&
                 export SENTRY_DSN=$$(cat /run/secrets/herald_sentry_dsn) &&
-                /app/herald
+                /app/herald-server
         networks:
             - reverse_network
             - prometheus_network
@@ -87,9 +89,10 @@ services:
             BOT_MAX_CONCURRENT: 5
             GITEA_URL: http://gitea:3000
             GITEA_TIMEOUT: 60
-            OPEN_ROUTER_MODEL: deepseek/deepseek-v4-flash
+            OPEN_ROUTER_MODEL: openai/gpt-5.6-luna-pro
             OPEN_ROUTER_TIMEOUT: 600
             METRICS_BIND_ADDR: 0.0.0.0:9100
+            SANDBOX_MAX_ITERATIONS: 32
 
     wireguard_server:
         image: linuxserver/wireguard

docker-compose.observability.yml

@@ -2,7 +2,7 @@ version: "3"
 
 services:
     tempo:
-        image: grafana/tempo:2.10.7
+        image: grafana/tempo:3.0.3
         command:
             - -config.file=/etc/tempo/tempo.yml
         configs:
@@ -31,7 +31,7 @@ services:
             - prometheus_network
 
     alertmanager:
-        image: prom/alertmanager:v0.33.1
+        image: prom/alertmanager:v0.34.1
         configs:
             - source: alertmanager_config
               target: /etc/alertmanager/alertmanager.yml
@@ -53,7 +53,7 @@ services:
             - reverse_network
 
     otel-collector:
-        image: otel/opentelemetry-collector-contrib:0.156.0
+        image: otel/opentelemetry-collector-contrib:0.161.0
         configs:
             - source: otel_collector_config
               target: /etc/otelcol-contrib/config.yaml
@@ -71,7 +71,7 @@ services:
             - prometheus_network
 
     prometheus:
-        image: prom/prometheus:v3.9.1
+        image: prom/prometheus:v3.13.3
         command:
             - --config.file=/etc/prometheus/prometheus.yml
             - --storage.tsdb.path=/prometheus

tempo/tempo.yml

@@ -8,10 +8,16 @@ distributor:
                 http:
                     endpoint: 0.0.0.0:4318
 
-ingester:
+live_store:
     max_block_duration: 5m
 
-compactor:
+backend_scheduler:
+    provider:
+        compaction:
+            compaction:
+                block_retention: 48h
+
+backend_worker:
     compaction:
         block_retention: 48h
 
@@ -21,4 +27,4 @@ storage:
         local:
             path: /var/tempo/traces
         wal:
-            path: /var/tempo/wal
+            path: /var/tempo/wal