chore(pmm-fb): repin both halves of the feature build (#1461)

## Summary

Moves both halves of `sidecar/pmm-fb/compose.yaml` forward together.

| Service | From | To |
| --- | --- | --- |
| `pmm-server` — `PMM_FB_TAG`, both defaults | `PR-4500-a2f83c2`
(2026-08-25) | **`PR-4500-2c43912`** — cut 2026-09-03 from percona/pmm
`PMM-15205-sep-fb` @ 53521917d |
| `sep-sidecar` | 249f673 (2026-08-25)
| **b97ee985fc64f841f611b3a057737814da308a61** — SEP `main`'s tip,
published 2026-09-04 by Jenkins `SEP/Build` #235 |

The PMM half was two builds behind — `PR-4500-d85ca73` also came and
went.

### What the new PMM build carries

`PMM-15205-sep-fb` was rebuilt as linear per-ticket history on `main`,
and three PRs have merged into it since a2f83c2:

| PR | What |
| --- | --- |
| percona/pmm#5759 | the `/sep/` nginx reverse proxy, productized out of
this harness's overlay |
| percona/pmm#5762 | SEP's secret files and the generated database
password |
| percona/pmm#5886 | the vendored SEP frontend synced to SEP `main`
c16578d |

### The side-car moves with it

This PR originally held `sep-sidecar` at 249f673, because nothing at
or after c16578d had been published and there was no image to move to.
That left the pair mismatched, PMM-new against SEP-old.

It no longer is. `main` was merged into `pmm` as 1efbbe8, and
`SEP/Build` #235 published `main`'s tip — 62 commits on from the old
pin. c16578d is an ancestor of it, so the frontend sync in
percona/pmm#5886 now has a side-car that answers it.

The three features that would have degraded are live instead. Each
symbol is present under `app/` at b97ee98 and absent at 249f673:

- **Support-case autocomplete** issues requests. It is gated on
`case_search_available` from `atw_config`, which this side-car sends.
- **The executor co-location warning** mounts. It needs `target_service`
on the host field's schema, which this side-car declares.
- **The `unlaunchable` status** (SEP-1943) arrives, so its badge is
exercised rather than unused.

## Tested

Both pins were resolved against Docker Hub before merge:
`perconalab/pmm-server-fb:PR-4500-2c43912` (pushed 2026-09-03) and
`percona/percona-sep:b97ee985fc64f841f611b3a057737814da308a61` (pushed
2026-09-04).

The side-car image was then held against the three repin checks the
harness README requires on the artifact rather than on the commit that
built it:

| Check | Result |
| --- | --- |
| `SECRETS_DIR` references in `settings-env.sh` | 4 |
| Grafana token mint | `grafana_service_account.py` present; the image's
`state` directory is `drwx------ sep sep` |
| `HEALTHCHECK`, read from the raw config blob | `CMD` runs
`healthcheck.sh`, start period 150 s |

No paired bring-up was run — this is a two-line pin change, and the
artifact checks are what the README asks for at repin time.

## Checklist

- [ ] New/modified functions have type hints and rST docstrings
- [ ] New tests added for new features or bug fixes
- [ ] All tests pass locally (`make test`)
- [x] Pre-commit hooks pass (`make run-pre-commit`)
- [ ] Database migrations generated if models changed (`make
makemigrations`)
- [ ] User-facing changes documented (README, inline help, UI text)
- [ ] Configuration changes documented with examples
- [x] Changelog fragment added under `changelog.d/` if the change is
user-facing (`make changelog-add`), or confirmed N/A (internal-only
change, or a same-release-cycle fix for an unreleased sibling ticket)

---------

Signed-off-by: Yan Orestes <yan.orestes@percona.com>

Author: yyyyyyyan

sidecar/pmm-fb/compose.yaml

@@ -45,7 +45,7 @@ x-sep-mysql-address: &sep_mysql_address 172.28.9.40
 services:
   pmm-server:
     # Default repeated on sep-mysql's PMM_FB_TAG build arg — a repin edits both
-    image: docker.io/perconalab/pmm-server-fb:${PMM_FB_TAG:-PR-4500-a2f83c2}
+    image: docker.io/perconalab/pmm-server-fb:${PMM_FB_TAG:-PR-4500-2c43912}
     platform: linux/amd64
     # The image ships start_period 25s with 3 retries at 4s, so it is marked
     # unhealthy around 37s while a cold start needs appreciably longer to first
@@ -74,7 +74,7 @@ services:
       - sep-pmm
 
   sep-sidecar:
-    image: docker.io/percona/percona-sep:249f6738ae7a4ba495b34f6ccc5edf0cad4db5c3
+    image: docker.io/percona/percona-sep:b97ee985fc64f841f611b3a057737814da308a61
     platform: linux/amd64
     # service_healthy, not service_started: SEP builds its settings once, at
     # process start, so a side-car released before pmm-server has written the
@@ -120,7 +120,7 @@ services:
       context: .
       dockerfile: Containerfile.mysql
       args:
-        PMM_FB_TAG: ${PMM_FB_TAG:-PR-4500-a2f83c2}
+        PMM_FB_TAG: ${PMM_FB_TAG:-PR-4500-2c43912}
     # service_started, not service_healthy: this node consumes none of the SEP
     # secret provisioning pmm-server's health now gates on, and ordering is all
     # it needs — pmm-managed starts answering registration requests later still.