license switch agpl -> busl1, sprints work, new product advisories

devops/services/authority/docker-compose.authority.yaml

@@ -40,7 +40,7 @@ services:
     restart: unless-stopped
 
   valkey:
-    image: valkey/valkey:8-alpine
+    image: valkey/valkey:9.0.1-alpine
     container_name: stellaops-authority-valkey
     command: ["valkey-server", "--save", "60", "1"]
     volumes:
@@ -56,3 +56,4 @@ volumes:
   mongo-data:
   valkey-data:
   authority-keys:
+

devops/services/orchestrator-config/docker-compose.orchestrator.yml

@@ -1,7 +1,7 @@
 version: "3.9"
 services:
   orchestrator-postgres:
-    image: postgres:16-alpine
+    image: postgres:18.1-alpine
     environment:
       POSTGRES_USER: orch
       POSTGRES_PASSWORD: orchpass
@@ -47,3 +47,4 @@ services:
 volumes:
   orch_pg_data:
   orch_mongo_data:
+

devops/services/orchestrator/Dockerfile

@@ -90,7 +90,7 @@ LABEL org.opencontainers.image.title="StellaOps Orchestrator WebService" \
       org.opencontainers.image.revision="${GIT_SHA}" \
       org.opencontainers.image.source="https://git.stella-ops.org/stella-ops/stellaops" \
       org.opencontainers.image.vendor="StellaOps" \
-      org.opencontainers.image.licenses="AGPL-3.0-or-later" \
+      org.opencontainers.image.licenses="BUSL-1.1" \
       org.stellaops.release.channel="${CHANNEL}" \
       org.stellaops.component="orchestrator-web"
 
@@ -117,7 +117,7 @@ LABEL org.opencontainers.image.title="StellaOps Orchestrator Worker" \
       org.opencontainers.image.revision="${GIT_SHA}" \
       org.opencontainers.image.source="https://git.stella-ops.org/stella-ops/stellaops" \
       org.opencontainers.image.vendor="StellaOps" \
-      org.opencontainers.image.licenses="AGPL-3.0-or-later" \
+      org.opencontainers.image.licenses="BUSL-1.1" \
       org.stellaops.release.channel="${CHANNEL}" \
       org.stellaops.component="orchestrator-worker"
 

devops/services/orchestrator/GA_CHECKLIST.md

@@ -84,7 +84,7 @@
 
 ## Compliance
 
-- [ ] AGPL-3.0-or-later license headers in all source files
+- [ ] BUSL-1.1 license headers in all source files
 - [ ] Third-party license notices collected and bundled
 - [ ] Attestation chain verifiable via `stella attest verify`
 - [ ] Air-gap deployment tested in isolated network

devops/services/signals-ops/docker-compose.signals.yml

@@ -37,7 +37,7 @@ services:
       retries: 5
 
   signals-valkey:
-    image: valkey/valkey:8-alpine
+    image: valkey/valkey:9.0.1-alpine
     ports:
       - "56379:6379"
     command: ["valkey-server", "--save", "", "--appendonly", "no"]
@@ -50,3 +50,4 @@ services:
 volumes:
   signals_artifacts:
   signals_mongo:
+