feat(workload): emit workload labels + dual-write containers from deployer

Project deploys (both standard and blue-green) now stamp the new
workload labels on every container and dual-write a row into the
containers index alongside the existing instances row. The legacy
project/stage/instance-id labels stay for now so operator runbooks
don't break — they will be removed after the migration soaks.

New labels:
- tinyforge.managed       (every Tinyforge container)
- tinyforge.workload.id   (workload row primary key)
- tinyforge.workload.kind ('project' | 'stack' | 'site')
- tinyforge.role          (stage name for projects)

ContainerConfig grows WorkloadID/WorkloadKind/Role fields. The
deployer resolves the project's workload row (guaranteed to exist
by boot-time backfill) and passes the IDs through. Container row
ID matches instance ID by construction so removeInstance can drop
both records together.

Stack and static-site managers still need the same treatment;
those land in the next commit.

internal/docker/client.go

@@ -8,10 +8,22 @@ import (
 )
 
 // Labels applied to all containers managed by Tinyforge.
+//
+// Workload-shaped labels (LabelWorkloadID, LabelWorkloadKind, LabelRole,
+// LabelManaged) are the canonical set going forward and what the reconciler
+// queries by. The legacy project/stage/instance-id labels are still emitted
+// alongside them for back-compat with anything that selects on them
+// (operator runbooks, monitoring scrape rules, ad-hoc shell debugging) — they
+// will be removed once the migration soaks.
 const (
 	LabelProject    = "tinyforge.project"
 	LabelStage      = "tinyforge.stage"
 	LabelInstanceID = "tinyforge.instance-id"
+
+	LabelManaged      = "tinyforge.managed"       // present on every Tinyforge-managed container
+	LabelWorkloadID   = "tinyforge.workload.id"   // workload row primary key
+	LabelWorkloadKind = "tinyforge.workload.kind" // 'project' | 'stack' | 'site'
+	LabelRole         = "tinyforge.role"          // stage name (project), service name (stack), '' (site)
 )
 
 // Client wraps the Docker Engine API client.

internal/docker/container.go

@@ -48,6 +48,19 @@ type ContainerConfig struct {
 	// InstanceID is the Tinyforge instance ID (used for labelling).
 	InstanceID string
 
+	// WorkloadID is the unifying primitive's row ID (Workload.ID). Future
+	// reconciler / global views key off this label, so it must be set on
+	// every Tinyforge-managed container (project, stack, site).
+	WorkloadID string
+
+	// WorkloadKind is 'project' | 'stack' | 'site'. Denormalized here so
+	// label-selector queries don't need to join through workloads.
+	WorkloadKind string
+
+	// Role is the per-kind sub-identifier: stage name for projects, service
+	// name for stacks, empty for sites. Used by the reconciler to upsert.
+	Role string
+
 	// Mounts is a list of bind mounts to attach to the container.
 	Mounts []mount.Mount
 
@@ -93,9 +106,22 @@ func (c *Client) CreateContainer(ctx context.Context, cfg ContainerConfig) (stri
 	for k, v := range cfg.Labels {
 		labels[k] = v
 	}
+	// Legacy labels (kept for back-compat with operator runbooks /
+	// monitoring scrape rules; will be removed after the workload soak).
 	labels[LabelProject] = cfg.Project
 	labels[LabelStage] = cfg.Stage
 	labels[LabelInstanceID] = cfg.InstanceID
+	// Workload-shaped labels — canonical going forward.
+	labels[LabelManaged] = "true"
+	if cfg.WorkloadID != "" {
+		labels[LabelWorkloadID] = cfg.WorkloadID
+	}
+	if cfg.WorkloadKind != "" {
+		labels[LabelWorkloadKind] = cfg.WorkloadKind
+	}
+	if cfg.Role != "" {
+		labels[LabelRole] = cfg.Role
+	}
 
 	containerCfg := &container.Config{
 		Image:        cfg.Image,