fix: Immich v2.7.5 compat, supply-chain hardening, and quality fixes (0.5.2) (#23)

* fix: Immich v2.7.5 compat, supply-chain hardening, and quality fixes (0.5.2)

- Remove assetCount pre-filter broken by Immich v2.7.5 API change; check
  MIN_FACE_COUNT after fetch_all_assets instead
- Replace curl|sh uv installer with COPY --from Docker stage (supply chain)
- Fix HEALTHCHECK to use kill -0 on PID file instead of static file test
- Fix CONFIG_FILE path to resolve inside DATA_DIR for volume persistence
- Fix EmbeddingCache singleton to re-init when cache_dir changes
- Fix fd leak in _suppress_output() with nested finally closes
- Fix silent exception on SQLite connection close in upload_tracker
- Log unexpected Frigate API keys at DEBUG in get_all_frigate_person_files
- Add reconcile FIFO-mapping debug log
- Pin all CI action SHAs; update setup-uv v8.2.0, upload/download-artifact,
  ruff-action v4.0.0

* chore: update lockfile

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

winnow/cache.py

@@ -101,17 +101,18 @@ class EmbeddingCache:
 
 # Singleton instance
 _cache: EmbeddingCache | None = None
+_cache_dir: str | None = None
 
 
 def get_cache(cache_dir: str = ".if_cache") -> EmbeddingCache:
     """Get or create the singleton cache instance.
 
-    Note: The ``cache_dir`` parameter is only used when creating the
-    singleton for the first time. Subsequent calls return the existing
-    instance regardless of ``cache_dir``. If you need a cache with a
-    different directory, instantiate ``EmbeddingCache`` directly.
+    Re-creates the instance when ``cache_dir`` changes so that test
+    isolation (which resets Config.DATA_DIR via _Config.reset()) always
+    writes to the correct directory rather than a stale one.
     """
-    global _cache
-    if _cache is None:
+    global _cache, _cache_dir
+    if _cache is None or _cache_dir != cache_dir:
         _cache = EmbeddingCache(cache_dir)
+        _cache_dir = cache_dir
     return _cache