search-with-proof group 4 + image: board, spend reservation, coordinator, search-task image

Board as immutable versioned blobs (coordinator sole writer); budget reserve/settle
before model calls; per-task and run caps; coordinator loop over an injected
executor; batch.py accepts a fixed allow-list of search variables; XSS browser
oracle; ousast-search-task image (Python, Node/TypeScript, PHP, Java 17, sqlite,
bwrap, chromium) built by CI. 103 tests on the host.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/engine-image.yml

@@ -11,6 +11,7 @@ on:
       - 'benchmarks/learn/engine_worker_service.py'
       - 'Dockerfile'
       - 'plane/Dockerfile.engine-task'
+      - 'plane/Dockerfile.search-task'
       - 'ops/frontend-retention/install.py'
       - 'pyproject.toml'
       - '.github/workflows/engine-image.yml'
@@ -35,6 +36,8 @@ jobs:
           - package: ousast-replay-task
             dockerfile: plane/Dockerfile.engine-task
             target: replay
+          - package: ousast-search-task
+            dockerfile: plane/Dockerfile.search-task
     steps:
       - uses: actions/checkout@v5
       - uses: docker/setup-buildx-action@v3