fix: address the defects found testing v1.33.0 across distro guests

[geodro]

A store preset that changes what a unit renders to could not reach a container that was already running. File mounts and the dashboard proxy env are read from the preset when the quadlet is written and are never stored on the service, while the reconcile re-rendered a unit only when the unit was missing or the saved YAML had changed, so the preset that moves phpMyAdmin behind the lerd-ui proxy landed on disk with the container still on a unit that had no mount for it and the dashboard answered 404 at the path the UI had already switched to. The quadlet is rendered every pass now and its content decides, which in a steady state costs a comparison. A container that started before its unit file was last written counts as stale too, since the install rewrites service quadlets long before it reaches the reconcile and leaves an already running container alone, leaving that pass nothing to notice. The install refreshes the store presets and reconciles after it starts services, so the pass that carries a store change into a container has the last word over the family discovery that rewrites consumer units behind it.

A default PHP version above a framework's ceiling resolved to the framework's floor. When nothing installed satisfies the range the fallback always answered the minimum, so scaffolding CakePHP on a machine whose only PHP is 8.5 asked for 8.1 rather than 8.4 and stopped there, which left CakePHP and CodeIgniter unscaffoldable on a stock install. It falls back to the bound the version actually missed.

php:rebuild is what the doctor, isolate and the shims all name when a PHP version is missing, and it only ever built the image. On a version this machine had never installed the build landed on nothing: php:list omitted it, the shims still called it uninstalled, and the run ended by failing to restart a unit that did not exist. It writes the unit first now, the way the ensure path does, so a failed build still leaves the version registered. isolate says when a pin names a version with no image instead of reporting a bare success, and the not installed error stops naming lerd install, which takes no version and could never have added the one being asked for.

Stopping a unit systemd has never loaded is the goal already met, not a failure. The stop set is built partly from the workers a site declares rather than from the units on disk, so a machine that never installed a declared worker named units systemd does not know and a clean shutdown printed a red line for each one. The launchd side has always treated its equivalent as success.

Closes #1487