feat(workload): emit workload labels + dual-write containers from deployer

Project deploys (both standard and blue-green) now stamp the new
workload labels on every container and dual-write a row into the
containers index alongside the existing instances row. The legacy
project/stage/instance-id labels stay for now so operator runbooks
don't break — they will be removed after the migration soaks.

New labels:
- tinyforge.managed       (every Tinyforge container)
- tinyforge.workload.id   (workload row primary key)
- tinyforge.workload.kind ('project' | 'stack' | 'site')
- tinyforge.role          (stage name for projects)

ContainerConfig grows WorkloadID/WorkloadKind/Role fields. The
deployer resolves the project's workload row (guaranteed to exist
by boot-time backfill) and passes the IDs through. Container row
ID matches instance ID by construction so removeInstance can drop
both records together.

Stack and static-site managers still need the same treatment;
those land in the next commit.

internal/docker/client.go

@@ -8,10 +8,22 @@ import (
 )
 
 // Labels applied to all containers managed by Tinyforge.
+//
+// Workload-shaped labels (LabelWorkloadID, LabelWorkloadKind, LabelRole,
+// LabelManaged) are the canonical set going forward and what the reconciler
+// queries by. The legacy project/stage/instance-id labels are still emitted
+// alongside them for back-compat with anything that selects on them
+// (operator runbooks, monitoring scrape rules, ad-hoc shell debugging) — they
+// will be removed once the migration soaks.
 const (
 	LabelProject    = "tinyforge.project"
 	LabelStage      = "tinyforge.stage"
 	LabelInstanceID = "tinyforge.instance-id"
+
+	LabelManaged      = "tinyforge.managed"       // present on every Tinyforge-managed container
+	LabelWorkloadID   = "tinyforge.workload.id"   // workload row primary key
+	LabelWorkloadKind = "tinyforge.workload.kind" // 'project' | 'stack' | 'site'
+	LabelRole         = "tinyforge.role"          // stage name (project), service name (stack), '' (site)
 )
 
 // Client wraps the Docker Engine API client.