[dan-petty]

Add devops k8s searxng-check, built on the shared probe code of crawl4ai-check. It sends six search requests through a port-forward (the keys of a JSON reply, a ! query that names an engine that is off, a !! query that redirects, a category that no kept engine serves) and tries three connects from two throwaway pods, so the NetworkPolicy applies to them. The k8s gate row now fails when the Deployment image differs from the image that the command was written for. A live reply of that image replaces the hand-made fixture of the web search tests. A bump of the image digest needs a person to run the command first.

Closes #3929

Change: openspec/changes/archive/2026-11-08-3929-searxng-check-command/

[dan-petty]

Test record for #3929

Live run, 2026-11-08. devops k8s searxng-check against the cluster by port-forward (one run, exit 0). Image: docker.io/searxng/searxng:2026.10.23-629368e40@sha256:aecad882e86eeb022b76351c8dce4eb48d0cbb16a5f1691f77ea32c96d317502.

Request	Target	Status	Hits	Result
json-general	<searxng-service> by forward	200	1	ok
json-it	same	200	50	ok
json-science	same	200	10	ok
bang-off-engine (!google python)	same	200	0	ok
bang-external (!!g python, redirect not followed)	same	302	-	ok
unused-category	same	200	1	ok

Pod (role)	Destination (role)	Result
<unlabeled-pod> (no searxng client label)	<searxng-service> port 8080	blocked
<searxng-pod> (label of searxng)	<metadata> port 80	blocked
<searxng-pod>	<private-cluster-ip> (roadmap-service ClusterIP)	blocked

Notes from the run:

• json-general gave 1 hit, because duckduckgo answered CAPTCHA (unresponsive_engines: duckduckgo). The it row had askubuntu, stackoverflow and superuser at "too many requests". Both are upstream rate limits, and the check accepts a kept engine that is unresponsive.
• The fixture tests/fixtures/searxng/search_reply.json is one more live request (q=python, categories=it) through a second port-forward, cut to its first 3 hits. search_reply_image.txt holds the image. Total live requests: 8 on the service, under the limit of about 30.
• Rollout rule: the change adds, removes, renames and tightens no setting. The only new value is the option default DEFAULT_SEARXNG_CHECK_LOCAL_PORT (8081). The example and live ConfigMap need no change. The tests of the example ConfigMap (test_configmap_rollout_rule, test_k8s_configmap_keys) pass.
• Nothing was applied to the cluster. The pods of the check are throwaway pods that the command removes.

Local checks. Full devops ci under the shared lock passed on the implement tree (exit 0, 14m14s; the test row is over 5 minutes, known #3593). After the rebase and the fixture commit: tests/k8s/test_searxng_check.py, tests/ai/test_web_search_searxng.py, tests/invariants/test_k8s_searxng.py (87 passed), ruff check, ruff format, devops docs generate --check, and the pre-commit hooks (including the OpenSpec gate after the archive) pass.

Fail-to-pass. Not applicable: this is a feat, and its tests were written first and failed at import before the module existed.

Decision for a person. Review the diff in tuicr, then merge.