Bump service images and update Tempo config

Update Woodpecker, Gitea, Herald, and observability stack
images to latest versions. Migrate Tempo config to v3
schema with live_store and backend_scheduler/worker.
Add Docker socket mount and sandbox iteration limit to
Herald, and switch its model and entrypoint.

docker-compose.core.yml

@@ -20,7 +20,7 @@ services:
             - prometheus_network
 
     woodpecker_server:
-        image: woodpeckerci/woodpecker-server:v3.17-alpine
+        image: woodpeckerci/woodpecker-server:v3.18.1-alpine
         volumes:
             - woodpeckerdata:/var/lib/woodpecker/
         entrypoint: /bin/sh -c "export WOODPECKER_GITEA_CLIENT=$$(cat /run/secrets/woodpecker_gitea_client) && export WOODPECKER_GITEA_SECRET=$$(cat /run/secrets/woodpecker_gitea_secret) && export WOODPECKER_AGENT_SECRET=$$(cat /run/secrets/woodpecker_agent_secret) && /bin/woodpecker-server"
@@ -37,7 +37,7 @@ services:
             - woodpecker_gitea_secret
 
     woodpecker_agent:
-        image: woodpeckerci/woodpecker-agent:v3.17-alpine
+        image: woodpeckerci/woodpecker-agent:v3.18.1-alpine
         volumes:
             - /var/run/docker.sock:/var/run/docker.sock
         entrypoint: /bin/sh -c "export WOODPECKER_AGENT_SECRET=$$(cat /run/secrets/woodpecker_agent_secret) && /bin/woodpecker-agent"
@@ -51,7 +51,7 @@ services:
             - woodpecker_agent_secret
 
     gitea:
-        image: docker.gitea.com/gitea:1.27.1
+        image: docker.gitea.com/gitea:1.27.3
         environment:
             - USER_UID=1000
             - USER_GID=1000
@@ -64,7 +64,9 @@ services:
             - reverse_network
 
     herald:
-        image: tintounn/herald:1.1
+        image: tintounn/herald:1.2
+        volumes:
+            - /var/run/docker.sock:/var/run/docker.sock
         entrypoint:
             - /bin/sh
             - -c
@@ -73,7 +75,7 @@ services:
                 export OPEN_ROUTER_API_KEY=$$(cat /run/secrets/herald_openrouter_token) &&
                 export WEBHOOK_SIG_HEADER_SECRET=$$(cat /run/secrets/herald_gitea_header_secret) &&
                 export SENTRY_DSN=$$(cat /run/secrets/herald_sentry_dsn) &&
-                /app/herald
+                /app/herald-server
         networks:
             - reverse_network
             - prometheus_network
@@ -87,9 +89,10 @@ services:
             BOT_MAX_CONCURRENT: 5
             GITEA_URL: http://gitea:3000
             GITEA_TIMEOUT: 60
-            OPEN_ROUTER_MODEL: deepseek/deepseek-v4-flash
+            OPEN_ROUTER_MODEL: openai/gpt-5.6-luna-pro
             OPEN_ROUTER_TIMEOUT: 600
             METRICS_BIND_ADDR: 0.0.0.0:9100
+            SANDBOX_MAX_ITERATIONS: 32
 
     wireguard_server:
         image: linuxserver/wireguard