Upgrade POC Elastic Stack to 9.4.2

[Jagadeeshck]

Motivation

• Bring the local/POC Elastic Stack references up to 9.4.2 to match current POC images and avoid mixed-version confusion.
• Centralise image tagging via a single ELK_VERSION variable so future bumps are one-line changes.
• Keep Fleet package policy logic that resolves and pins real semver values to avoid the earlier "latest"-related Fleet error.

Description

• Updated the POC env and compose defaults: set ELK_VERSION=9.4.2 in .env.poc and added ELK_VERSION=9.4.2 to .env.example.
• Routed active Elastic images through the ELK_VERSION variable in docker-compose.poc.yml and docker-compose.yml so Elasticsearch, Kibana, Fleet Server and Elastic Agent use ${ELK_VERSION:-9.4.2}.
• Preserved and validated the Fleet bootstrap flow that installs packages via the registry and resolves the concrete semver (APM_VER, DOCKER_VER, etc.) before POSTing package_policies, avoiding literal "latest" in policy bodies.
• Updated docs and comments to reference 9.4.2, added a small docker manifest inspect checklist in docs/poc-setup.md, added an explicit upgrade note instructing users to run ./scripts/demo_reset.sh, docker compose -f docker-compose.poc.yml --env-file .env.poc pull, and ./scripts/demo_up.sh, and adjusted OTel/README compatibility notes and resource table.
• Minor supporting edits: updated config/otel-collector-poc.yaml comment, tweaked requirements.txt comment, and added focused validation tests in tests/test_poc_pipeline.py to ensure consistent ELK_VERSION pins, no stale active 9.4.0/9.3.x references (except allowed history), and that Fleet package policy JSON uses resolved semver variables rather than latest.

Testing

• Static checks: ran python -m compileall -q src tests which completed with only a SyntaxWarning from an existing return in a finally (non-fatal).
• Unit tests: ran pytest tests/test_poc_pipeline.py -q and all tests passed (10 passed).
• Shell validation: ran bash -n on demo scripts (scripts/demo_up.sh scripts/demo_run.sh scripts/demo_verify.sh scripts/demo_reset.sh scripts/verify_poc.sh) with no syntax errors.
• Compose/YAML validation: parsed docker-compose.poc.yml and docker-compose.yml with yaml.safe_load() and ran docker compose ... config (render) could not be executed because Docker is not available in this environment.
• Image availability checks: attempted docker manifest inspect for the three 9.4.2 images and an HTTP manifest probe, but both could not be completed here due to missing docker binary and outbound network/Tunnel restrictions, so those checks are documented in docs/poc-setup.md for local verification by users.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5ecb390ab4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Limit stale-version scan to tracked files

This repo-wide rglob also reads gitignored/untracked files, so the test fails for a documented local workflow if a developer has an older .env.poc.local with ELK_VERSION=9.4.0 (or any local notes/cache/venv file containing the stale tokens), even though the committed files are correct. Since .env.poc.local is explicitly gitignored and called out in the POC docs as an optional local override, this check should restrict itself to tracked files or exclude ignored paths.

Useful? React with 👍 / 👎.