feat(workload): emit workload labels + dual-write containers from deployer

Project deploys (both standard and blue-green) now stamp the new
workload labels on every container and dual-write a row into the
containers index alongside the existing instances row. The legacy
project/stage/instance-id labels stay for now so operator runbooks
don't break — they will be removed after the migration soaks.

New labels:
- tinyforge.managed       (every Tinyforge container)
- tinyforge.workload.id   (workload row primary key)
- tinyforge.workload.kind ('project' | 'stack' | 'site')
- tinyforge.role          (stage name for projects)

ContainerConfig grows WorkloadID/WorkloadKind/Role fields. The
deployer resolves the project's workload row (guaranteed to exist
by boot-time backfill) and passes the IDs through. Container row
ID matches instance ID by construction so removeInstance can drop
both records together.

Stack and static-site managers still need the same treatment;
those land in the next commit.

internal/deployer/bluegreen.go

@@ -71,6 +71,7 @@ func (d *Deployer) blueGreenDeploy(
 
 	instanceID := uuid.New().String()
 	subdomain := d.buildSubdomain(project, stage, settings, imageTag)
+	workloadID := d.resolveProjectWorkloadID(project.ID)
 	containerName := docker.ContainerName(project.Name, stage.Name, imageTag)
 	portStr := fmt.Sprintf("%d/tcp", project.Port)
 	envVars := d.mergeEnvVars(project, stage.ID)
@@ -86,6 +87,9 @@ func (d *Deployer) blueGreenDeploy(
 		Project:      project.Name,
 		Stage:        stage.Name,
 		InstanceID:   instanceID,
+		WorkloadID:   workloadID,
+		WorkloadKind: string(store.WorkloadKindProject),
+		Role:         stage.Name,
 		Mounts:       mounts,
 		CpuLimit:     stage.CpuLimit,
 		MemoryLimit:  stage.MemoryLimit,
@@ -125,6 +129,7 @@ func (d *Deployer) blueGreenDeploy(
 		return containerID, "", instanceID, fmt.Errorf("create instance record: %w", err)
 	}
 	instanceID = inst.ID
+	d.upsertContainerForInstance(project, stage, inst, workloadID)
 
 	if err := d.store.SetDeployInstanceID(deployID, instanceID); err != nil {
 		slog.Warn("link deploy to instance", "error", err)
@@ -138,6 +143,8 @@ func (d *Deployer) blueGreenDeploy(
 	if err := d.store.UpdateInstanceStatus(instanceID, "running"); err != nil {
 		slog.Warn("update instance status", "error", err)
 	}
+	inst.Status = "running"
+	d.upsertContainerForInstance(project, stage, inst, workloadID)
 	d.publishInstanceStatus(instanceID, project.ID, stage.ID, "running")
 
 	// Step 4: Health check the green container.
@@ -188,6 +195,7 @@ func (d *Deployer) blueGreenDeploy(
 	if err := d.store.UpdateInstance(inst); err != nil {
 		slog.Warn("update instance with proxy ID", "error", err)
 	}
+	d.upsertContainerForInstance(project, stage, inst, workloadID)
 
 	// Step 6: Stop the blue container.
 	if blueInstance != nil {