upstream(immich): release-notes sources + DB-pin & VectorChord backup/restore notes

cc-ci-plan/upstream/immich.md

@@ -0,0 +1,32 @@
+# Upstream sources — immich
+
+| service | image | source repo | releases / changelog |
+|---------|-------|-------------|----------------------|
+| app | ghcr.io/immich-app/immich-server | https://github.com/immich-app/immich | https://github.com/immich-app/immich/releases |
+| immich-machine-learning | ghcr.io/immich-app/immich-machine-learning | https://github.com/immich-app/immich | https://github.com/immich-app/immich/releases |
+| redis | docker.io/valkey/valkey | https://github.com/valkey-io/valkey | https://github.com/valkey-io/valkey/releases |
+| database | ghcr.io/immich-app/postgres | https://github.com/immich-app/base-images | https://github.com/immich-app/immich/blob/main/docker/docker-compose.yml |
+
+## Standing notes
+
+- **DB image is pinned BY immich-server, not bumped independently.** abra cannot survey/upgrade this
+  recipe (`FATA … Docker references with both a tag and digest are currently not supported`) because
+  `database` is pinned `image:tag@sha256:…`. Use the box-item-4 direct check: the authoritative source
+  for the DB tag is **immich's own `docker/docker-compose.yml` at the immich-server release tag**
+  (`https://raw.githubusercontent.com/immich-app/immich/<vX.Y.Z>/docker/docker-compose.yml`). Pin the
+  recipe's `database` image to EXACTLY what that compose pins for the matching immich-server version —
+  do NOT take the newest `ghcr.io/immich-app/postgres` tag. Newer tags (pg-15/16/17/18,
+  vectorchord0.5.x, pgvectors0.3.0) exist but moving ahead of what immich-server ships forces a
+  **pg-major data migration** and an unsupported extension combo.
+- **immich-server v2.7.5 (latest, 2026-04-13) pins** `ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23`
+  — verified against immich's v2.7.5 compose AND the live ghcr manifest (tag resolves to that exact
+  digest). This is identical to what the recipe already pins, so **no DB image change for v2.7.5**.
+- **VectorChord DB backup/restore needs the search_path sed.** A plain `pg_dump` of the
+  VectorChord/pgvecto.rs DB emits `SELECT pg_catalog.set_config('search_path', '', false);`. Importing
+  that as-is leaves the vector/vchord type + operator references unresolvable, so the first such
+  statement errors. immich's official restore (docs.immich.app/administration/backup-and-restore) pipes
+  the dump through:
+  `sed "s/SELECT pg_catalog.set_config('search_path', '', false);/SELECT pg_catalog.set_config('search_path', 'public, pg_catalog', true);/g"`
+  before `psql … --single-transaction --set ON_ERROR_STOP=on`. Omitting that sed (immich PR #1's
+  `pg_backup.sh`) is why the single-transaction import aborted wholesale and `ci_marker` was lost on
+  restore — fixed in the upgrade PR's `pg_backup.sh`.