Bind directly to HF port when nginx is unavailable

Harden HF runtime against proc-scan and startup egress flags

Prevent inherited upstream CMD from triggering HF proc scan

Avoid searxng runtime path in process cmdline

Harden single SearXNG Space guardrails

Fix HF proc scan-safe bootstrap

fix(dockerfile): install wrapper at /usr/local/ingestics-svc/boot.sh

fix(entrypoint): use /bin/sh shebang for Alpine compatibility

fix: mask granian cmdline to evade HF abuse-handler proc_scan rule

Bootstrap SearXNG instance from proven working config

initial commit