ci: run the agent with an init process; document the controller upgrade

- init: true on the agent so processes left behind by build tools are reaped,
  as the inbound-agent image asks for.
- Redeploying an older controller from docker-compose.yml upgrades Jenkins
  and moves it from Java 17 to 25: say to back up jenkins_home first, update
  plugins that fail to load, and run the job once before relying on it.

ci/jenkins/README.md

@@ -82,6 +82,17 @@ so an existing Jenkins deployed from this file keeps its jobs and credentials
 when redeployed; it switches to the stock image, and its builds wait until
 the agent (step 3) is connected.
 
+That redeploy also upgrades Jenkins, and from Java 17 (the old default) to
+Java 25, unless `JENKINS_IMAGE` pins your current image. Before it:
+
+1. **Back up the data volume** (`jenkins_home`), e.g. with a Coolify volume
+   backup or `docker run --rm -v <volume>:/v -v "$PWD":/b alpine tar czf
+   /b/jenkins_home.tgz -C /v .`, so you can go back to the old image.
+2. After it starts, open **Manage Jenkins**. Plugins that need a newer
+   version show up there as failed to load; update them under **Plugins →
+   Updates** and restart.
+3. Run the job once (**LIST_SNAPSHOTS** is a quick check) before relying on it.
+
 ### 2. The agent node
 
 **Manage Jenkins → Nodes → New Node**, a permanent agent:

ci/jenkins/docker-compose.agent.yml

@@ -10,6 +10,9 @@ services:
       context: .
       dockerfile: Dockerfile
     restart: unless-stopped
+    # Reap the processes build tools leave behind (dotnet build servers,
+    # Gradle daemons, adb), as the inbound-agent image's docs ask for.
+    init: true
     environment:
       # Jenkins as seen from inside Docker (e.g. http://<jenkins container
       # name>:8080), not the public URL, which is behind Cloudflare Access.