chore: fix packaging metadata, dependency alerts and Docker tag guidance

pyproject.toml

@@ -22,7 +22,7 @@ classifiers = [
 dependencies = [
     "httpx==0.28.1",
     "pyyaml==6.0.2",
-    "typer[all]==0.16.0",
+    "typer==0.16.0",
 ]
 
 [project.scripts]

skills/fessctl/references/installation.md

@@ -15,7 +15,7 @@ resolve_fessctl() {
   FESSCTL="docker run --rm \
     -e FESS_ENDPOINT -e FESS_ACCESS_TOKEN -e FESS_VERSION \
     --add-host=host.docker.internal:host-gateway \
-    ghcr.io/codelibs/fessctl:${FESS_VERSION:-latest}"
+    ghcr.io/codelibs/fessctl:0.3.0"
 }
 
 resolve_fessctl
@@ -64,7 +64,7 @@ Two networking notes for reaching a Fess server running on the **host**:
 
 ## Choosing the Docker tag
 
-The Docker image is published at `ghcr.io/codelibs/fessctl`. Pin a tag rather than `latest` for reproducible runs. The convention is to keep the image tag close to the Fess version it has been validated against — if you are talking to a Fess 15.8 server, prefer the tag whose `FESS_VERSION` default matches. Inspect available tags at <https://github.com/codelibs/fessctl/pkgs/container/fessctl> if unsure.
+The Docker image is published at `ghcr.io/codelibs/fessctl`. **Image tags are fessctl release versions** — `0.1.0`, `0.2.0`, `0.3.0`, and so on — plus a `snapshot` tag, which is not a release and should not be pinned to. There is no `latest` tag, so an untagged `ghcr.io/codelibs/fessctl` fails to pull with `manifest unknown`; always name a release tag. The tag says nothing about which Fess server you are talking to — that is selected at runtime by `FESS_VERSION`, so the same image works against every supported Fess version. Inspect available tags at <https://github.com/codelibs/fessctl/pkgs/container/fessctl> if unsure.
 
 ## Verifying the install
 

skills/fessctl/references/troubleshooting.md

@@ -128,18 +128,19 @@ Recovery: install with `pipx install fessctl`, `uv tool install fessctl`, or pre
 
 ```
 denied: requested access to the resource is denied
+manifest unknown
 ```
 
 Causes:
 
-- Rate limiting from anonymous pulls.
-- Pulling from a private mirror without prior `docker login`.
+- `denied` — rate limiting from anonymous pulls, or pulling from a private mirror without a prior `docker login`.
+- `manifest unknown` — the tag does not exist. Most often this is the implicit `latest`, which this image does not publish.
 
 Recovery:
 
 ```bash
 docker login ghcr.io                         # if behind auth
-docker pull ghcr.io/codelibs/fessctl:0.3.0   # pin a specific tag, not `latest`
+docker pull ghcr.io/codelibs/fessctl:0.3.0   # always name a release tag
 ```
 
-If `latest` is unavailable in your environment, prefer a pinned version tag matching `FESS_VERSION`.
+The tag is a **fessctl** release version, not a Fess version, and there is no `latest` — a bare `docker pull ghcr.io/codelibs/fessctl` therefore fails with `manifest unknown`. Which Fess server the container talks to is decided by `FESS_VERSION` at runtime, independently of the tag.