feat(config): adopt existing Compose instances with recoverable rollback

[roodboi]

Legacy Compose projects previously had no qualified format transition that could keep their existing containers and data volumes. hack config adopt --dry-run now previews a strict static subset, and explicit hack config adopt publishes a native candidate while retaining the verified original container IDs, network identity and referenced named volumes. Running originals require an explicit, separately journaled --stop.

Preparation and publication use a distinct versioned private adoption store. The store binds the canonical legacy input pair, compiler admission, Compose config hashes, engine identity, exact container mounts and volume creation facts. It saves the original files for inode-preserving rollback, journals switch/rollback before pathname changes, and fences upgraded discovery while publication or an effect is pending. Interrupted transitions require explicit recovery; uncertain effects retain their pending evidence.

Adopted up --detach, restart, down, ps, plain logs and exec consume the retained originals. They never enter ordinary native namespace allocation, create replacement volumes or add native nonce labels to legacy objects. down stops and retains data anchors. Reports contain field provenance/status or symbolic workload status; private source values and binding facts stay out of reports and mutation output. Stopped containers remain bound through their configured NetworkID, while active network membership must equal the running original IDs.

Validation:

• Final full typecheck and check pass; CLI tasks ran fresh, unchanged DB tasks used the shared cache. Privacy check and all 25 changed TypeScript files pass lint. CLI reference regenerated, matching current-branch executable and compiler built.
• Final whole test: 3,262 CLI tests pass, 73 normal harness cases skip, zero fail; 18,386 assertions across 314 files in 329.49 seconds. CLI ran fresh and unchanged DB tests used the shared cache. Live/platform integration skips are not counted as acceptance; the real Docker adoption flow below ran separately.
• Focused owner regressions: 46 generation tests / 849 assertions and 71 binding tests / 798 assertions. Pipe/TTY suppression plus timeout/observation controls: 10 tests / 36 assertions; existing TTY cancellation/input/foreground/compiled controls: 10 tests / 47 assertions. Final selector regression: 23 tests / 44 assertions, including invalid-directory refusal and a forged typed getter error canary that failed before redaction hardening. Final matching compiled refusal controls passed with zero engine effects.
• Disposable real Compose/PostgreSQL acceptance on the prior frozen adoption product source: original SQL row readback before migration, after retained-ID execution and after rollback; real partial-stop SIGINT, process-killed switch and rollback with explicit repair, candidate edit/removal refusal, exact original file inode/byte restoration and retained resource identities. Later changes only hardened invalid-path/error diagnostics; final focused/compiled checks cover those. Exact cleanup removed only the captured two containers, one network and one verified volume. No ports, global proxy/DNS/trust, Event Agent or application settings changed.
• The routing reconciliation passed 37 affected tests / 156 assertions. Final head also reconciles the qualified finite after-hook increment on next: adoption source, shared filesystem owner, CLI contract, import mapping/parser and prior acceptance fixture remain byte-identical to the preceding qualified head. All merged after-hook intent/store methods survive the mechanical filesystem extraction, and adopted dispatch still precedes ordinary native selection. Fresh build, full typecheck and privacy/lint pass with unchanged DB cache hits; shared generation/after-hook/selector and adopted dispatch/rollback controls pass 112 tests / 429 assertions. Unchanged whole-suite and live adoption gates were not repeated.

This is an optional bounded NC04 increment. Linked/separate Git roots, typed local/managed-env inheritance, profiles, routing/hooks, advanced unsupported mappings, recreation, run, attached startup and live application migration refuse. Full NC04 remains open for those cases. Publication/rechecks do not freeze external editors or Docker actors. Unmodified v4 clients cannot be universally fenced; migration and rollback require the upgraded selector/launcher boundary.

Native generation version-one wire bytes and error-class identity are preserved by the mechanical shared private file-owner extraction. The release signal is feat for the optional adoption capability; no stable installation or publication is changed.