fix(elasticsearch): force fresh image pull, clarify non-root failure

The published 8.19.18 images are correct (verified: real ES 8.19.18,
run as root, migration + privilege-drop in place). But some upgrades
were left running a stale cached Elasticsearch 7.17.9 image that starts
as uid 1000, producing the reported "mv: cannot move '/data/config' ...
Permission denied" and "AccessDeniedException[.../data/nodes/0]".

- Bump version to 8.19.18-3 to force Home Assistant / Docker to pull a
  fresh image tag instead of reusing the cached one.
- Add an explicit root check on the first init pass (before any move or
  chown) so a non-root start fails with a clear, actionable message
  instead of the cryptic permission error, and wrap the config-archive
  mv with the same clear failure. The re-exec'd uid-1000 pass returns
  before this check, so the privilege drop still works.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

elasticsearch/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 8.19.18-3 (14-07-2026)
+- Force a fresh image pull for users left on a stale cached image (some upgrades kept running the old Elasticsearch 7.17.9 image, failing with `mv: cannot move '/data/config' ... Permission denied` and `AccessDeniedException[/usr/share/elasticsearch/data/nodes/0]`). Fully stop and update the add-on so Home Assistant pulls this build.
+- Replaced the cryptic `Permission denied` failure with a clear message when the add-on is not running as root (the state that caused the failure above).
+
 ## 8.19.18-2 (14-07-2026)
 - Minor bugs fixed
 ## 8.19.18 (2026-07-14)

elasticsearch/config.yaml

@@ -90,4 +90,4 @@ slug: elasticsearch
 startup: services
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/elasticsearch
-version: 8.19.18-2
+version: 8.19.18-3

elasticsearch/rootfs/usr/local/bin/addon-init.sh

@@ -31,6 +31,17 @@ PERSISTENT_HOME="/data"
 VERSION_MARKER="$PERSISTENT_HOME/.addon-upstream-version"
 OPTIONS_JSON="/data/options.json"
 
+# This first pass must be root so it can relocate and take ownership of
+# pre-existing /data content written by an earlier (root) install. If it
+# is not root (e.g. an old cached image that pinned USER 1000:0, or the
+# container being forced to another user), the moves/chowns below fail
+# with a cryptic "Permission denied"; fail loudly with the real reason.
+if [ "$(id -u)" -ne 0 ]; then
+    echo "FATAL: the Elasticsearch add-on must start as root (currently uid $(id -u))."
+    echo "If you upgraded from an older version, the running image is likely stale - fully stop and update/reinstall the add-on so Home Assistant pulls the current image."
+    exit 1
+fi
+
 ############################
 # 1 Export user env_vars   #
 ############################
@@ -94,7 +105,11 @@ if [ -n "$data_version" ] && [[ $current_major =~ ^[0-9]+$ ]]; then
         if [ -d "$PERSISTENT_HOME/config" ] && [ ! -L "$PERSISTENT_HOME/config" ]; then
             config_backup="$PERSISTENT_HOME/config.bak-$data_version"
             if [ ! -e "$config_backup" ]; then
-                mv "$PERSISTENT_HOME/config" "$config_backup"
+                if ! mv "$PERSISTENT_HOME/config" "$config_backup"; then
+                    echo "FATAL: could not archive the old config to $config_backup."
+                    echo "This add-on must run as root to migrate a previous install. Restore a Home Assistant backup and ensure the add-on is not forced to a non-root user."
+                    exit 1
+                fi
                 echo "NOTICE: previous config archived to $config_backup. Re-apply any custom settings to the new config."
             fi
         fi