[acamarata]

Four small debt rows, one commit each. D-0429 is not touched (see below).

Rows

• D-0422 fixed. internal/docker now exports ParseServiceSpecs and ParseContainerStates. internal/deploy calls them: decodeContainerStates is deleted, parseComposeModel gets its specs from docker.ParseServiceSpecs and decodes only the extra fields it needs (image, container name, mounts, network aliases). The exported docker.HealthTimeout wrapper existed only for the copy, so it is removed. TestCopiedParsersMatchDocker is deleted, since there is one implementation now. The existing parseComposeModel and RemoteStates tests still cover the deploy side.
• D-1148 fixed. The removing script now keeps a failed rm in rc and ends with exit $rc, so an early failure is no longer hidden by a later success. New test TestPrunePreDeployTarsReportsAnEarlierRmFailure puts a stub rm on PATH that fails for the first tar in drop order (03, then 02 and 01 succeed). It fails on the old loop ("a failed rm was reported as a clean prune") and passes with the fix.
• D-1164 fixed. In the kill-mid-remove leg of scripts/e2e/proxy-swap.sh, a build that had already exited when killed is now FAIL (exit 1) instead of a WARN followed by PASS. Not run here: needs Docker and the e2e fixtures (see below).
• D-1176 fixed. scripts/e2e/multi-app-isolation.sh mints a token for a real app_a member ($UA) that claims app_b, and for both notes and projects asserts it reads 0 rows, cannot insert (permission-error) and leaves app_b's row count at 2. The metadata permission checks app_members on user id and claimed app, so the expected result holds by design. Not run here (Docker).
• D-0429 BLOCKED. The row needs a lead ruling or ADR on whether the resolved .env.<cascade> snapshot is a compose env input, and is scheduled under P7-DEPL-24 (debt triage: "needs a lead ruling in the DEPL Invalidations"). No code change.

Checks run

• gofmt -l internal: clean
• go vet ./internal/deploy/... ./internal/docker/...: clean
• go test ./internal/deploy/... ./internal/docker/... -count=1: 686 passed
• go build ./...: ok
• bash -n on both e2e scripts: ok
• D-1148 test run against the old loop: fails; with the fix: passes
• The two e2e script changes were not executed: no Docker on this worker, so they have no failing-before/passing-after run.