Compose --remove-orphans can remove WUDup or its Docker endpoint proxy during updates #891

Pre-flight

• I searched existing issues and this isn't a duplicate
• I'm running the latest release, image tag, or commit available to me

Current behavior

Pending updates (src/wudup/updater_lifecycle_health.py, _remove_orphans) and WebUI retag apply (src/wudup/web_retag_apply.py, _compose_up_retag_services) recreate services with docker compose up --remove-orphans whenever the project is not shared with another Compose file set. Compose then removes every container in the project whose service is no longer defined in the Compose file. This happens no matter which services were passed to up.

The recreate-scope guards check only the services that are being updated:

• fix(updater): block updates that would stop WUDup's Docker endpoint #888 adds validate_self_update_scope for pending updates.
• fix(retag): block retags that would stop WUDup or its Docker endpoint #889 adds validate_retag_recreate_scope for retags.

Neither guard checks orphan containers. If WUDup itself, or the socket proxy that serves WUDup's DOCKER_HOST, is running as an orphan in the stack being updated, the update removes it. WUDup then loses Docker access and cannot finish the update, check health, or roll back. That is the same failure as the socket-proxy incident behind #887.

Expected behavior

Before running up --remove-orphans, WUDup should check whether any orphan container in the project is WUDup itself (by WUD_WEB_RESTART_CONTAINER identity) or the container serving a network DOCKER_HOST. If one is, it should either skip --remove-orphans or block the update before any mutation, with plain-language guidance. If those containers cannot be checked, it should fail closed.

Steps to reproduce

1. Run WUDup with DOCKER_HOST=tcp://socket-proxy:2375, where socket-proxy is defined in a Compose stack under DOCKER_BASE alongside another service, app.
2. Remove the socket-proxy service from that stack's Compose file but leave its container running. For example, move it to another file without recreating it.
3. Update or retag app from the WebUI.
4. docker compose up ... --remove-orphans app removes the running socket-proxy container, and later Docker calls from WUDup fail.

This is found by code reading and has not been reproduced against a live stack.

Logs and command output

N/A - found by code review. Expected symptom: "lookup socket-proxy ... no such host" after the recreate step, then a failed rollback.

Deployment method

Docker Compose image

Why this is a separate issue

This behavior existed before #888 and #889 and is shared by both the pending-update and retag paths. Those PRs add only the recreate-scope guard for the services being updated; changing how orphan removal is decided is a separate change.