Harden shared lifecycle rollback

docker/docs/Dockerfile

@@ -29,7 +29,7 @@ RUN if [ -n "${LLMS_TXT_MCP_VERSION}" ]; then \
  && rm /tmp/context-kit-docs-constraints.txt
 
 COPY entrypoint.sh /usr/local/bin/docs-mcp-entrypoint
-RUN chmod +x /usr/local/bin/docs-mcp-entrypoint
+RUN chmod 0555 /usr/local/bin/docs-mcp-entrypoint
 
 RUN mkdir -p /data /models /etc/context-kit
 ENV HF_HOME=/models \

docker/web-search/.dockerignore

@@ -1,5 +1,7 @@
 *
 !Dockerfile
+!http-entrypoint.mjs
+!mcp-probe.mjs
 !patch-mcp-web-search.mjs
 !overrides/
 !overrides/bing.js

docker/web-search/Dockerfile

@@ -29,6 +29,8 @@ RUN npm install -g "@zhafron/mcp-web-search@${MCP_WEB_SEARCH_VERSION}" \
   && rm /tmp/patch-mcp-web-search.mjs /tmp/context-kit-bing-provider.js \
   && npm cache clean --force
 
+RUN chmod 0555 /usr/local/lib/context-kit
+
 ENV CHROME_PATH=/usr/bin/chromium \
   DEFAULT_SEARCH_PROVIDER=searxng \
   HOME=/tmp \