fix: keep running containers until stack pull/build succeeds (#1657)

* fix: keep running containers until stack pull/build succeeds

Acquire images before reconcile, capture a recovery generation for
compensation, and only remove classified orphans after handoff.

* fix: address recovery audit blockers for safe stack updates

Retire abandoned and expired recovery artifacts, probe compensated
runtimes before reporting rollback success, preserve local Docker when
deleting a node, validate the exact Compose invocation before capture,
and repair updateStack return-contract fixtures.

* fix: resolve ESLint errors blocking CI on this branch

Unused-import and unused-variable errors left over from the stack
deletion refactor: MeshService in stacks.ts (its opt-out cascade moved
into DeployedStackDeletionService), a redundant pruneVolumes
destructure in deleteDeployedStack (the real one is re-derived from
the same input object inside runDeletionBody), and an unused beforeAll
import in a Docker-integration test stub. Also scopes the webhook
pull-action case body in a block to satisfy no-case-declarations;
purely syntactic, no behavior change.

* fix: harden recovery probe, cleanup retry, and failed-pull Docker test

Reject absent or unhealthy expected replicas before reporting rollback
success, keep cleanup records until artifacts are actually removed, fail
closed when a mesh override cannot be generated, and assert a real
failed pull leaves the original container running.

* fix: verify recovery probe image identity and stack-scoped override paths

Reject recovered runtimes that use the wrong image or leave scale-zero
services running, and confine tombstone override deletion to the intent
stack directory so forged cross-stack paths cannot be swept.

* test: batch notification cap fixtures in a SQLite transaction

Unbatched 1200-row inserts were timing out at the default 30s under
CI load even though the same assertions pass in under 2s when green.

backend/src/__tests__/stack-self-protected-routes.test.ts

@@ -164,7 +164,7 @@ describe('self stack lifecycle refusal', () => {
   });
 
   it('allows update on a non-self stack', async () => {
-    mockUpdateStack.mockResolvedValue(undefined);
+    mockUpdateStack.mockResolvedValue({ recoveryId: null });
     const res = await request(app)
       .post('/api/stacks/web/update')
       .set('Cookie', authCookie);
@@ -177,7 +177,7 @@ describe('self stack lifecycle refusal', () => {
 describe('POST /api/stacks/bulk self stack skip', () => {
   beforeEach(() => {
     stubSelfProject('sencho');
-    mockUpdateStack.mockResolvedValue(undefined);
+    mockUpdateStack.mockResolvedValue({ recoveryId: null });
     mockGetContainersByStack.mockResolvedValue([{ Id: 'c1' }]);
   });