catalog: the lifecycle implementation itself (fixes the previous commit)

The previous commit landed only the new test/badge files: a 'git stash' used
to compare REUSE.md ref-check output silently dropped the staged index, so
every modification to an existing file was left behind and that commit does
not build. This adds the metadata field, the predicates, the fail-closed
deploy gate, the catalog filter, the funcmap entries, the template edits and
the docs that those tests exercise.

controller/internal/stacks/deploy.go

@@ -160,6 +160,16 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 	stackDir := filepath.Dir(stack.ComposePath)
 	meta := LoadMetadata(stackDir)
 
+	// --- Lifecycle gate (defence in depth) ---
+	// The API handler refuses this first, with the customer-facing Hungarian message. This second
+	// check exists because DeployStack is the manager-level choke point EVERY caller goes through,
+	// and metadata is already loaded here — so a future caller that does not route through the API
+	// cannot bypass the rule by simply not knowing about it. Deliberately before the first mutation.
+	if !meta.CanInstall() {
+		clearDeploying()
+		return "", fmt.Errorf("stack %q is not installable (lifecycle: %s)", req.StackName, meta.EffectiveLifecycle())
+	}
+
 	// --- Memory validation ---
 	var deployWarning string
 	reservedMB := m.cfg.System.ReservedMemoryMB