v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

Closes R-47. No new agent coupling — MinAgent stays 0.90.0.

The replay needs a running DB container, so both restore paths started the
WHOLE stack first, giving the application a window to rebuild the very schema
objects the dump was about to create. Measured live on 2026-07-19 (H4,
DIAG-immich-restore-round2): immich-server rebuilt clip_index two seconds
before the dump's CREATE INDEX, the replay aborted "already exists" under
ON_ERROR_STOP=1, and immich reported schema drift. The data survived only
because pg_dump emits COPY before CREATE INDEX.

Both paths now open a DB-ONLY window: only the stack's database service(s)
come up, the dump is replayed with the app still down, and the full start
runs only after the replay exits 0. Fail-closed: a dump with no identifiable
DB service refuses BEFORE the first mutation. Every exit from the window
still does a best-effort full start, so a failed restore never leaves a box
with a database and no application.

New: appbackup.DBServiceNames (yaml.v3 services-map parse — never a line
scan; immich's top-level volume keys are the decoy) sharing dbTypeForImage
with DiscoverDatabases; stacks.Manager.StartStackServices (refuses an empty
list — argument-less `up -d` is a full start); RedeployFromEnv split into
PersistUnitRedeployConfig + its unchanged tail. StackDataProvider's
RecreateStackFromUnit becomes RecreateStackDefinitionFromUnit — the hidden
`up -d` inside the old name is what carried the defect on the local path.

19 new tests (ordering plus state-at-replay-time, zero-mutation fail-closed
effects, replay-failure bring-up, parser decoys, empty-list refusal); three
companion red-proofs run and reverted. 23/23 packages green.

Not yet live-validated: STOP-1 supervised reconstitute, golden 0.153.0.

controller/internal/backup/offbox_3a_test.go

@@ -25,17 +25,22 @@ type offbox3aProvider struct {
 	has   map[string]bool
 }
 
-func (p *offbox3aProvider) GetStackComposePath(string) (string, bool)        { return "", false }
-func (p *offbox3aProvider) ListDeployedStacks() []StackSummary               { return nil }
-func (p *offbox3aProvider) GetStackHDDMounts(string) []string                { return nil }
-func (p *offbox3aProvider) GetStackHDDPath(n string) string                  { return p.hdd[n] }
-func (p *offbox3aProvider) GetDockerVolumes(string) []string                 { return nil }
-func (p *offbox3aProvider) StopStack(string) error                           { return nil }
-func (p *offbox3aProvider) StartStack(string) error                          { return nil }
-func (p *offbox3aProvider) RefreshAndIsRunning(string) bool                  { return false }
-func (p *offbox3aProvider) GetStackRecoveryInfo(string) (RecoveryInfo, bool) { return RecoveryInfo{}, false }
+func (p *offbox3aProvider) GetStackComposePath(string) (string, bool) { return "", false }
+func (p *offbox3aProvider) ListDeployedStacks() []StackSummary        { return nil }
+func (p *offbox3aProvider) GetStackHDDMounts(string) []string         { return nil }
+func (p *offbox3aProvider) GetStackHDDPath(n string) string           { return p.hdd[n] }
+func (p *offbox3aProvider) GetDockerVolumes(string) []string          { return nil }
+func (p *offbox3aProvider) StopStack(string) error                    { return nil }
+func (p *offbox3aProvider) StartStack(string) error                   { return nil }
+func (p *offbox3aProvider) RefreshAndIsRunning(string) bool           { return false }
+func (p *offbox3aProvider) GetStackRecoveryInfo(string) (RecoveryInfo, bool) {
+	return RecoveryInfo{}, false
+}
 func (p *offbox3aProvider) RecoverStackSecrets(string, []string) map[string]string { return nil }
-func (p *offbox3aProvider) RecreateStackFromUnit(_, _ string, _ map[string]string) error { return nil }
+func (p *offbox3aProvider) RecreateStackDefinitionFromUnit(_, _ string, _ map[string]string) error {
+	return nil
+}
+func (p *offbox3aProvider) StartStackServices(string, []string) error { return nil }
 func (p *offbox3aProvider) GetStackClassifiedBinds(n string) ([]ClassifiedBind, bool) {
 	return p.binds[n], p.has[n]
 }