Merge upstream main into v6 upgrade branch

Keep the runtime jwt-keys sidecar (cc-ci cannot pre-insert PEM secrets) and
the Rust docspec image on top of upstream v6.0.4.

compose.yml

@@ -127,7 +127,7 @@ services:
       labels:
         - "traefik.enable=false"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
-        - "coop-cloud.${STACK_NAME}.version=0.4.4+v5.6.1"
+        - "coop-cloud.${STACK_NAME}.version=1.0.1+v6.0.4"
     user: "${DOCKER_USER:-1000}"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080"]
@@ -231,7 +231,7 @@ services:
 
   # Valkey of yhub: holds updates not yet persisted to postgres, so it is a store, not a cache
   yhub-valkey:
-    image: valkey/valkey:8.1.10-alpine
+    image: valkey/valkey:8.1.11-alpine
     command: ["valkey-server", "--maxmemory-policy", "volatile-lru", "--appendonly", "yes", "--appendfsync", "everysec"]
     healthcheck:
       test: ["CMD", "valkey-cli", "ping"]