feat(orchestrate): C5b — wire the real up-saga phases (spec 09) (#9)

Assemble the concrete up phases over the C5a engine (BuildUp → []Phase):

  preflight → network → generate → shared(health-gated) →
  compose-up(per project) → hooks(postUp, per project)

- preflight: docker daemon reachable (full doctor matrix is X6).
- network: idempotent EnsureNetwork(devstack_shared) under the flock — never
  auto-removed (no compensation).
- generate: GenerateAll + writeIfChanged; runs BEFORE the compose phases (the
  files must exist to `up`) and re-arms on a config edit (fingerprint = the
  on-disk workspace/devstack yaml).
- shared: RegisterUp ref rows + `compose up -d` only the shared services the
  requested projects `uses`, then health-gate each (Healthy if it declares a
  healthcheck, else Started) via internal/health. Compensation drops the refs.
- compose-up (per project): `compose up -d` (+ optional --build); compensation
  `compose down` (never -v — a failed up never drops volumes). Re-armed by a
  devstack.yaml edit.
- hooks (per project): postUp via internal/hooks (OSExecer + the DB ledger +
  flock).

Engine refinement: a FAILED mutating phase now runs its OWN compensation too
(it may have partially applied — e.g. compose-up created containers), while its
saga_phase row is KEPT failed (so `status` can surface it); succeeded phases
still unwind in reverse with their rows cleared.

Deferred + flagged (slot in as more phases, no engine change): clone (gitx),
provision (needs the shared-Postgres host-port coupling), secrets (M4/S6),
trust (N5), firstRun hooks (need the provisioned-volume scope_key).

Wiring is unit-tested with a mock docker client + a fake compose runner + a real
temp ledger + a real temp workspace over the embedded templates: full happy
path (network ensured, refs added, both stacks up'd, files written, postUp ran),
near-instant re-run (all skips bar AlwaysRun preflight/hooks), and a project
compose-up failure that compensates the shared refs to zero and downs the
project. The real end-to-end daemon test lands with G1's isolation harness
(parameterized devstack-it-<pid> network/prefix — the saga must not touch a real
devstack_shared).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gustavobertoi

internal/orchestrate/orchestrate.go

@@ -102,7 +102,7 @@ func (s *Saga) Run(ctx context.Context, phases []Phase) ([]Record, error) {
 		s.emit(rec)
 
 		if err != nil {
-			s.compensate(ctx, done)
+			s.compensate(ctx, &p, done)
 			return records, fmt.Errorf("phase %q failed: %w", p.Name, err)
 		}
 		if rec.Status == StatusOK && p.Mutating && p.Compensate != nil {
@@ -179,25 +179,36 @@ func (s *Saga) runBody(ctx context.Context, p Phase) (detail any, err error) {
 	return p.Run(ctx)
 }
 
-// compensate unwinds the succeeded mutating phases in reverse, clearing each
-// phase row so a re-run redoes it. A compensation error is logged, not fatal —
+// compensate unwinds mutating work after a failure. The FAILED phase's own
+// compensation runs first (it may have partially applied — e.g. compose-up
+// created some containers) but its row is KEPT as failed so `status` can surface
+// it. Then the succeeded mutating phases unwind in reverse, each with its row
+// cleared so a re-run redoes it. A compensation error is logged, not fatal —
 // best-effort cleanup must not mask the original failure.
-func (s *Saga) compensate(ctx context.Context, done []Phase) {
+func (s *Saga) compensate(ctx context.Context, failed *Phase, done []Phase) {
+	if failed != nil && failed.Mutating && failed.Compensate != nil {
+		s.runCompensation(ctx, *failed)
+	}
 	for i := len(done) - 1; i >= 0; i-- {
 		p := done[i]
-		if p.Compensate != nil {
-			if err := p.Compensate(ctx); err != nil {
-				s.DB.LogEvent("saga", s.qualified(p), "compensation failed: "+err.Error())
-			} else {
-				s.DB.LogEvent("saga", s.qualified(p), "compensated")
-			}
-		}
+		s.runCompensation(ctx, p)
 		_ = s.withLock(ctx, func() error {
 			return s.DB.ClearPhase(s.Workspace, p.Scope, p.Name)
 		})
 	}
 }
 
+func (s *Saga) runCompensation(ctx context.Context, p Phase) {
+	if p.Compensate == nil {
+		return
+	}
+	if err := p.Compensate(ctx); err != nil {
+		s.DB.LogEvent("saga", s.qualified(p), "compensation failed: "+err.Error())
+	} else {
+		s.DB.LogEvent("saga", s.qualified(p), "compensated")
+	}
+}
+
 func (s *Saga) fingerprint(ctx context.Context, p Phase) (string, error) {
 	if p.AlwaysRun || p.Fingerprint == nil {
 		return "", nil