fix: stabilize retained Compose resource observations

[roodboi]

Retained Compose startup can refuse a valid job exit when network membership and container state are read at different moments. Bracket membership with verified container observations and discard only changing running states within the original aggregate deadline and output budget. Foreign members, undeclared bridge membership, replaced identities and stable mismatches still refuse; job completion remains bound to the existing scheduler's fresh-attempt proof.

The deterministic regression starts the original job, makes it exit during the membership read, and verifies that the dependent can start after a stable observation. Controls cover foreign and replaced resources, same-ID network birth changes, wrong-bridge membership, unstable deadline exhaustion and unchanged completion authority. This does not establish the cause of earlier hosted failures or provide an atomic Docker snapshot; delayed endpoint removal can still refuse. Additional inspection calls are confined to retained-resource verification.

Validation: 94 binding tests / 1,041 assertions passed, including seven focused race controls; CLI and focused test TypeScript checks passed; changed-file lint passed with one existing complexity warning. All twelve exact-head CI checks passed, including Docker E2E, runtime models and all four compiler platforms. Fresh M3 live acceptance remains pending. No release or performance claim.

Tracks HACK-1222.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}