Bump service images and update Tempo config

Update Woodpecker, Gitea, Herald, and observability stack
images to latest versions. Migrate Tempo config to v3
schema with live_store and backend_scheduler/worker.
Add Docker socket mount and sandbox iteration limit to
Herald, and switch its model and entrypoint.

docker-compose.observability.yml

@@ -2,7 +2,7 @@ version: "3"
 
 services:
     tempo:
-        image: grafana/tempo:2.10.7
+        image: grafana/tempo:3.0.3
         command:
             - -config.file=/etc/tempo/tempo.yml
         configs:
@@ -31,7 +31,7 @@ services:
             - prometheus_network
 
     alertmanager:
-        image: prom/alertmanager:v0.33.1
+        image: prom/alertmanager:v0.34.1
         configs:
             - source: alertmanager_config
               target: /etc/alertmanager/alertmanager.yml
@@ -53,7 +53,7 @@ services:
             - reverse_network
 
     otel-collector:
-        image: otel/opentelemetry-collector-contrib:0.156.0
+        image: otel/opentelemetry-collector-contrib:0.161.0
         configs:
             - source: otel_collector_config
               target: /etc/otelcol-contrib/config.yaml
@@ -71,7 +71,7 @@ services:
             - prometheus_network
 
     prometheus:
-        image: prom/prometheus:v3.9.1
+        image: prom/prometheus:v3.13.3
         command:
             - --config.file=/etc/prometheus/prometheus.yml
             - --storage.tsdb.path=/prometheus