probe target: explicit container for paperless-ngx and immich; ambiguity refused (R-630)

No image: line moved.

paperless-ngx has no container named after its stack, so its probe had NEVER run on any box.
immich has four immich-* containers and no exact match, so the old first-prefix rule picked
whichever came first - possibly the database.

The gate now resolves the target by the same four rules as findProbeContainerMeta: exact name,
explicit container, a UNIQUE prefix, else refuse - and refusing is right, because verifying waits
on this probe and a successful update of such an app gets stopped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,23 @@
+## The probe TARGET is now decidable, and ambiguity is refused rather than guessed (2026-09-22, R-630)
+
+**No `image:` line moved.** `healthcheck.container` added to `paperless-ngx` (`paperless-webserver`)
+and `immich` (`immich-server`), and the gate learned the field.
+
+**Why these two.** The controller resolves a probe target by the stack's own name, and neither app
+has a container called after its stack: paperless-ngx has `paperless-webserver`/`-postgres`/`-redis`
+(nothing even begins with `paperless-ngx`), so **its probe had never run on any box**; immich has
+four `immich-*` containers and no exact match, so the old first-prefix rule picked whichever the
+container list happened to yield — it could have been the database.
+
+**Why it is a CONVICTION now, not a warning.** A probe that resolves to nothing is not merely
+unjudgeable: `verifying` waits on it, so a SUCCESSFUL update of such an app is stopped by
+`failAndHold`. Measured on paperless-ngx 2026-09-22 — `failed` at +313.0 s, front door 404 after,
+the controller's own words `not healthy within 5m0s (last: no probe container)`.
+
+The gate now resolves the target by the same four rules as `findProbeContainerMeta`: exact stack
+name, explicit `container`, a **unique** prefix, else refuse. Eight new decoy cases, including the
+no-PyYAML mode CI runs.
+
 ## The six versions the twenty-eight proved go live (2026-09-22, R-462)
 
 Operator-approved from `DRILL-the-28-2026-09-22.md`'s promotion list. One commit per app,