v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

Closes R-47. No new agent coupling — MinAgent stays 0.90.0.

The replay needs a running DB container, so both restore paths started the
WHOLE stack first, giving the application a window to rebuild the very schema
objects the dump was about to create. Measured live on 2026-07-19 (H4,
DIAG-immich-restore-round2): immich-server rebuilt clip_index two seconds
before the dump's CREATE INDEX, the replay aborted "already exists" under
ON_ERROR_STOP=1, and immich reported schema drift. The data survived only
because pg_dump emits COPY before CREATE INDEX.

Both paths now open a DB-ONLY window: only the stack's database service(s)
come up, the dump is replayed with the app still down, and the full start
runs only after the replay exits 0. Fail-closed: a dump with no identifiable
DB service refuses BEFORE the first mutation. Every exit from the window
still does a best-effort full start, so a failed restore never leaves a box
with a database and no application.

New: appbackup.DBServiceNames (yaml.v3 services-map parse — never a line
scan; immich's top-level volume keys are the decoy) sharing dbTypeForImage
with DiscoverDatabases; stacks.Manager.StartStackServices (refuses an empty
list — argument-less `up -d` is a full start); RedeployFromEnv split into
PersistUnitRedeployConfig + its unchanged tail. StackDataProvider's
RecreateStackFromUnit becomes RecreateStackDefinitionFromUnit — the hidden
`up -d` inside the old name is what carried the defect on the local path.

19 new tests (ordering plus state-at-replay-time, zero-mutation fail-closed
effects, replay-failure bring-up, parser decoys, empty-list refusal); three
companion red-proofs run and reverted. 23/23 packages green.

Not yet live-validated: STOP-1 supervised reconstitute, golden 0.153.0.

controller/cmd/controller/main.go

@@ -1328,10 +1328,11 @@ func (a *stackAdapter) RecoverStackSecrets(name string, names []string) map[stri
 	return out
 }
 
-// RecreateStackFromUnit restores the app definition from the unit's compose dir into the stack dir,
-// then redeploys with the reconstructed full env (re-pulling the pinned image). Secrets in fullEnv were
-// recovered from the guest, never regenerated.
-func (a *stackAdapter) RecreateStackFromUnit(name, composeSrcDir string, fullEnv map[string]string) error {
+// RecreateStackDefinitionFromUnit restores the app definition from the unit's compose dir into the
+// stack dir and persists app.yaml from the reconstructed full env. Secrets in fullEnv were recovered
+// from the guest, never regenerated. It starts NOTHING — the restore flow brings the database service
+// up alone for the dump replay and only then starts the whole stack (R-47).
+func (a *stackAdapter) RecreateStackDefinitionFromUnit(name, composeSrcDir string, fullEnv map[string]string) error {
 	s, ok := a.mgr.GetStack(name)
 	if !ok {
 		return fmt.Errorf("stack %q not found", name)
@@ -1347,7 +1348,12 @@ func (a *stackAdapter) RecreateStackFromUnit(name, composeSrcDir string, fullEnv
 			return fmt.Errorf("restoring %s from unit: %w", fname, err)
 		}
 	}
-	return a.mgr.RedeployFromEnv(name, fullEnv)
+	return a.mgr.PersistUnitRedeployConfig(name, fullEnv)
+}
+
+// StartStackServices brings up only the named compose services (the DB-only replay window, R-47).
+func (a *stackAdapter) StartStackServices(name string, services []string) error {
+	return a.mgr.StartStackServices(name, services)
 }
 
 // RefreshAndIsRunning forces a docker ps scan before checking state.