feat(docker): pull-check + comparaison déterministe par stack (tâche 2 SJ-5)

- template docker/pull-check.sh.tpl (pull sans up, inspect before/after)
- dockerPull: parseDockerPullCheck + buildDockerPullResult (TDD) — compare
  image id/digest/label OCI → services up_to_date|updates_available|error,
  changes operation=pulled ; erreurs registry nettoyées (URL/token/password)
- dockerDedupKey (digests prioritaires, fallback image ids) + DockerImageChange.dedupKey
- pullCheckStack: SSH + upsert docker_stack_services, refuse stack non enabled,
  refresh Docker séparé (hors refreshMachine, pas de pull auto)
- execute: runAction(opts.stackId), branche docker_pull_check, injection stackDir
  (corrige docker_inspect_current) ; route: allowlist Docker passifs + pull_check,
  destructives toujours hors API jusqu'à action_requests (SJ-6)

Pas de migration (schéma SJ-4 suffisant). tsc 0 erreur · 85 tests · build OK.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

shared/types.ts

@@ -183,6 +183,7 @@ export interface DockerImageChange {
   fromDigest?: string | null;
   toDigest?: string | null;
   operation: "pulled" | "recreated" | "pruned";
+  dedupKey?: string;                // empreinte fonctionnelle (mutualisation Hermes)
 }
 
 export interface DockerExecutionResult {