Pin R2R image to v3.6.6 and record dormant-upstream sustainability risk

## Context
Investigation on 2026-06-22 of the R2R upstream (SciPhi):
- Production runs **R2R v3.6.3** (image pulled ~Sep 2025); `deploy/compose.yaml` uses the moving tag `sciphiai/r2r:latest`.
- Newest artifact that exists is **v3.6.6** (PyPI + Docker, 2025-08-17; added GPT-5 support). No GitHub Release was cut for it — the Releases page is frozen at v3.6.5 (2025-06-06).
- Last commit to R2R `main`: **2025-11-07**, then nothing. The project is dormant.
- Cause: the team (YC W2024, formerly SciPhi) rebranded to **Event Horizon Labs**, now 'an AI research lab automating all of investing' — a pivot off RAG. sciphi.ai marketing still claims active maintenance; the git/Docker/YC artifacts contradict it.

Implication: Cirdi's retrieval engine has no upstream fixes or security patches coming.

## Actions
- [ ] Pin `sciphiai/r2r:v3.6.6` in `deploy/compose.yaml` (stops surprise `:latest` jumps; gets GPT-5 support + ~3 patch releases of fixes over current v3.6.3).
- [ ] Treat v3.6.6 as the permanent upstream ceiling.
- [ ] If Cirdi must outlive this dependency, open a separate spike to evaluate alternative self-hostable RAG engines.

---
**Update (2026-06-23):** the CIRED.digital technical report was finalized and delivered (archived in `papiers/sent/`, 2026-01) before this finding, so there is no live chapter to amend. The sustainability risk is tracked in this issue and in project memory; the costs-chapter action item is dropped.

Read deploy/compose.yaml and locate the R2R service image reference. Replace the moving sciphiai/r2r:latest tag with sciphiai/r2r:v3.6.6, then verify the compose configuration still uses the intended image. Done means the deployment is pinned to v3.6.6 and no longer follows the upstream latest tag.

Written by the indexing model from the issue text.