v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

Closes R-47. No new agent coupling — MinAgent stays 0.90.0.

The replay needs a running DB container, so both restore paths started the
WHOLE stack first, giving the application a window to rebuild the very schema
objects the dump was about to create. Measured live on 2026-07-19 (H4,
DIAG-immich-restore-round2): immich-server rebuilt clip_index two seconds
before the dump's CREATE INDEX, the replay aborted "already exists" under
ON_ERROR_STOP=1, and immich reported schema drift. The data survived only
because pg_dump emits COPY before CREATE INDEX.

Both paths now open a DB-ONLY window: only the stack's database service(s)
come up, the dump is replayed with the app still down, and the full start
runs only after the replay exits 0. Fail-closed: a dump with no identifiable
DB service refuses BEFORE the first mutation. Every exit from the window
still does a best-effort full start, so a failed restore never leaves a box
with a database and no application.

New: appbackup.DBServiceNames (yaml.v3 services-map parse — never a line
scan; immich's top-level volume keys are the decoy) sharing dbTypeForImage
with DiscoverDatabases; stacks.Manager.StartStackServices (refuses an empty
list — argument-less `up -d` is a full start); RedeployFromEnv split into
PersistUnitRedeployConfig + its unchanged tail. StackDataProvider's
RecreateStackFromUnit becomes RecreateStackDefinitionFromUnit — the hidden
`up -d` inside the old name is what carried the defect on the local path.

19 new tests (ordering plus state-at-replay-time, zero-mutation fail-closed
effects, replay-failure bring-up, parser decoys, empty-list refusal); three
companion red-proofs run and reverted. 23/23 packages green.

Not yet live-validated: STOP-1 supervised reconstitute, golden 0.153.0.

controller/internal/appbackup/appdata.go

@@ -39,10 +39,18 @@ type StackDataProvider interface {
 	// fail-closed gate decides what to do. The unit is never the source of secrets.
 	RecoverStackSecrets(name string, names []string) map[string]string
 
-	// RecreateStackFromUnit restores an app's definition from the unit's compose dir into the stack
-	// dir, writes app.yaml from fullEnv (encrypting secret fields), and (re-)deploys it via
-	// `docker compose up -d`, which re-pulls the pinned image. Secrets are NEVER regenerated.
-	RecreateStackFromUnit(name, composeSrcDir string, fullEnv map[string]string) error
+	// RecreateStackDefinitionFromUnit restores an app's DEFINITION from the unit's compose dir into
+	// the stack dir and writes app.yaml from fullEnv (encrypting secret fields). Secrets are NEVER
+	// regenerated. It starts NOTHING: the caller owns the bring-up order, because a DB-bearing app
+	// must have its database service started alone for the dump replay (R-47). It was
+	// `RecreateStackFromUnit` until v0.153.0 and ended in a full `docker compose up -d` — that full
+	// start before the replay IS the H4 race.
+	RecreateStackDefinitionFromUnit(name, composeSrcDir string, fullEnv map[string]string) error
+
+	// StartStackServices brings up ONLY the named compose services, leaving the rest of the stack
+	// down — the DB-only window in which a dump is replayed without the application racing it.
+	// Implementations must REFUSE an empty list (an argument-less `up -d` is a full start).
+	StartStackServices(name string, services []string) error
 
 	// GetStackClassifiedBinds returns the app's backup-classified compose binds + whether it carries a
 	// (valid) backup block (Task 2, referential coupling). INERT — no tier consumes it yet; wired now