fix(docker): add jdk.net module to the jlink runtime

[Jan-Kazlouski-elastic]

Closes #498

Every crawl in the published images failed on its first HTTP request with NoClassDefFoundError: jdk/net/Sockets, so nothing was indexed.

Dockerfile.wolfi builds the runtime JDK with jlink and omitted the jdk.net module. httpclient5 5.6 loads jdk.net.Sockets while initializing DefaultHttpClientConnectionOperator, so the class was missing at runtime. 1.0.0 still shipped httpclient5 5.1, which does not touch that class, so only builds after the 5.6 bump (#485) are affected. Reverting the bump is not an option because it would reopen CVE-2026-64607 and the pinned httpcore5 CVEs.

Changes

• Add jdk.net to the jlink --add-modules list in Dockerfile.wolfi
• Run an actual crawl in .buildkite/scripts/test-wolfi-image.sh, so runtime gaps in the trimmed JDK fail CI instead of a published image

Verification

The Wolfi base images require registry auth, so the real image could not be built locally. Instead this was A/B tested on the published 1.0.1-SNAPSHOT image with the application and httpclient5 5.6.3 held constant and only the jlink module set swapped:

Module set	Result
without jdk.net (current main)	NoClassDefFoundError: jdk/net/Sockets, 0 pages visited
with jdk.net (this PR)	exit 0, Finished a crawl. Result: success, 2 pages visited

java --describe-module jdk.net confirms that module exports the jdk.net package containing Sockets.

The updated Wolfi test script was run against both images: it passes on the fixed one and exits non-zero on the broken one, so it does guard this regression. The Wolfi image build itself is still only exercised in CI.

Checklists

Pre-Review Checklist

• This PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check crawler.yml.example and elasticsearch.yml.example)
• This PR has a meaningful title
• This PR links to all relevant GitHub issues that it fixes or partially addresses
  • If there is no GitHub issue, please create it. Each PR should have a link to an issue
• this PR has a thorough description
• Covered the changes with automated tests
• Tested the changes locally
• Added a label for each target release version (example: v0.1.0)
• Considered corresponding documentation changes
• Contributed any configuration settings changes to the configuration reference
• Ran make notice if any dependencies have been added

Changes Requiring Extra Attention

• Security-related changes (encryption, TLS, SSRF, etc)
• New external service dependencies added.

Adds one JDK module to the runtime image, which slightly increases image size. It keeps httpclient5 5.6.3 and its CVE fixes in place.

Related Pull Requests

• fix(deps): bump httpclient5 to 5.6.3 for CVE-2026-64607 #485

Release Note

Fixed crawls failing immediately with NoClassDefFoundError: jdk/net/Sockets in the Docker images.

[github-actions]

💚 Backport PR(s) successfully created

Status	Branch	Result
✅	1.0	#500

This backport PR will be merged automatically after passing CI.