Adds search/opensearch.yml — a single-node OpenSearch deployment wired up
as the opencloud search engine backend via SEARCH_ENGINE_TYPE=open-search.
The security plugin is disabled because the service is only reachable on
the internal opencloud-net bridge (no published port). Do not publish or
proxy this without enabling the security plugin first.
The disk-based shard allocation watermarks are disabled so the index
does not flip to read-only on modest disks, which otherwise silently
turns bulk upserts into no-ops.
