deps: bump nginx / milvus / etcd / ragflow-es / searxng minors

[botAGI]

Low-risk patch/minor bumps for infra images, grouped into one unit.

Image	Var	Current → Latest
nginx	NGINX_VERSION	1.30.0-alpine → 1.31.3-alpine3.24-perl
milvusdb/milvus	MILVUS_VERSION	v2.6.15 → v2.6.20
quay.io/coreos/etcd	MILVUS_ETCD_VERSION	v3.5.25 → v3.7.0
docker.io/elasticsearch (RAGFlow)	RAGFLOW_ES_VERSION	9.4.0 → 9.4.3
docker.io/searxng/searxng	SEARXNG_VERSION	2026.5.10-df1f24fb7 → 2026.7.19-6da6eee26

Notes / gotchas

• Nginx: the report's latest is the -alpine3.24-perl variant — decide whether we want the -perl flavour or the plain 1.31.x-alpine tag to match the current image shape. nginx.conf is a single-file bind-mount, so after changing the image restart the container (inode rebind) or the old config sticks.
• etcd v3.5 → v3.7 is a minor family jump — verify Milvus v2.6.20 supports etcd 3.7 before pairing (they share a data dir).
• Milvus and RAGFlow-ES are patch bumps → lowest risk; SearXNG is date-tag based.

Definition of Done

• arm64 present for every image: docker manifest inspect <image>:<tag> | grep -c '"architecture": "arm64"' ≥ 1
• Bump the pins in templates/versions.env
• bash tests/compose/test_image_tags_exist.sh core/compose.yml green
• If rendered config changes: AGMIND_GOLDEN_ACCEPT=1 bash tests/golden/run.sh --update --update-all (verify drift is expected)
• Live-validate on a DGX Spark: agmind doctor = 0 errors
• Rollback confirmed: agmind update --rollback
• PR against develop

Part of #131 · data source: #130