feat(deployer): configurable per-workload deploy strategy (blue-green for built sources)

Add a deploy_strategy field to each source's config blob — "" (default),
"recreate", or "blue-green" — validated in each source's Validate and read on
the deploy path. No new DB column, no migration: the field rides inside the
existing SourceConfig JSON and every existing workload decodes "" to its
historical behavior (image -> blue-green, others -> recreate).

The real gap this closes: dockerfile and static stopped the old container
before creating the new one on every redeploy — a downtime window image never
had. Their blue-green branch now:
- names the new "green" container with a unique suffix so it coexists with the
  still-serving blue (plumbed into both the container name AND the proxy
  forwardHost);
- skips the collision teardown that destroyed blue early;
- gates green — an HTTP readiness probe (deps.Health.Check) when a healthcheck
  is configured, else the existing liveness window;
- swaps the route via a pure upsert (no pre-DeleteRoute) so NPM repoints in
  place with no gap;
- persists green into the single runtime-state row BEFORE reaping blue, so a
  crash mid-swap can never orphan green or leave the row pointing at a removed
  container (state.go/teardown.go/reconcile.go stay untouched).

image honors explicit "recreate" (reap existing containers after pull, before
cutover); its default blue-green path is unchanged. compose stays
stack-managed and rejects "blue-green" at Validate so the contract is honest.
static forces recreate for storage-backed deno sites — blue-green would mount
the same RW volume into both containers at once.

Shared helper internal/workload/plugin/strategy.go (ValidateStrategy +
BuildGreenName). Backend-only (phase 1); the field is usable today via the
app's advanced-JSON editor — a friendly toggle + i18n follow in phase 2.
Tests: ValidateStrategy matrix, per-source Validate (incl. the empty-key
backward-compat lock), and effectiveStrategy defaults + the deno gate. Design
+ adversarial review: docs/plans/DEPLOY_STRATEGY_PLAN.md.

internal/workload/plugin/source/compose/compose.go

@@ -28,6 +28,12 @@ import (
 type Config struct {
 	ComposeYAML        string `json:"compose_yaml"`
 	ComposeProjectName string `json:"compose_project_name"`
+	// DeployStrategy is accepted for parity with the other sources but a
+	// compose stack only supports recreate (docker compose up -d
+	// --remove-orphans). "" and "recreate" are honored; "blue-green" is
+	// rejected at Validate so the contract is honest in the UI rather than
+	// silently accepting a value compose can't deliver.
+	DeployStrategy string `json:"deploy_strategy,omitempty"`
 }
 
 type source struct{}
@@ -70,6 +76,11 @@ func (*source) Validate(cfg json.RawMessage) error {
 	if strings.TrimSpace(c.ComposeYAML) == "" {
 		return fmt.Errorf("compose source: compose_yaml is required")
 	}
+	// allowBlueGreen=false: a whole-stack blue-green is not implemented, so
+	// reject it here rather than silently running recreate.
+	if err := plugin.ValidateStrategy(c.DeployStrategy, false); err != nil {
+		return fmt.Errorf("compose source: %w", err)
+	}
 	spec, err := stack.Parse(c.ComposeYAML)
 	if err != nil {
 		return fmt.Errorf("compose source: parse yaml: %w", err)

internal/workload/plugin/source/compose/strategy_test.go

@@ -0,0 +1,37 @@
+package compose
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+const validComposeYAML = "services:\n  web:\n    image: nginx:alpine\n    ports:\n      - \"80\"\n"
+
+func composeCfg(strategy string) json.RawMessage {
+	m := map[string]any{"compose_yaml": validComposeYAML}
+	if strategy != "" {
+		m["deploy_strategy"] = strategy
+	}
+	b, _ := json.Marshal(m)
+	return b
+}
+
+func TestValidate_Strategy_RejectsBlueGreen(t *testing.T) {
+	cases := []struct {
+		strategy string
+		wantErr  bool
+	}{
+		{"", false},          // backward-compat
+		{"recreate", false},  // the only thing compose can do
+		{"blue-green", true}, // not supported for a whole stack
+		{"rolling", true},
+	}
+	for _, c := range cases {
+		t.Run("strategy="+c.strategy, func(t *testing.T) {
+			err := (&source{}).Validate(composeCfg(c.strategy))
+			if (err != nil) != c.wantErr {
+				t.Fatalf("Validate(strategy=%q) err=%v, wantErr=%v", c.strategy, err, c.wantErr)
+			}
+		})
+	}
+}