Persist runner state across restarts (stop /tmp wipe)

[NathanEdg]

What

The runner wrote compose files and .env data into /tmp while its systemd unit ran with PrivateTmp=true. A private /tmp is a fresh tmpfs on every (re)start, so compose projects and other deploy artifacts were destroyed whenever the runner restarted. This moves all runner-owned state to a persistent location and ensures it survives restarts.

Changes

• Compose data out of /tmp — compose_up and compose_up_stream now write to /var/lib/lockethq/compose/<project>/ instead of std::env::temp_dir(), matching the existing persistent convention already used by the proxy module (/var/lib/lockethq/traefik).
• Systemd unit (runner/lockethq-runner.service) — PrivateTmp=true → false, and added StateDirectory=lockethq so systemd creates/owns /var/lib/lockethq and never clears it on restart. ProtectSystem=full leaves /var writable, so no extra ReadWritePaths is needed.
• "Update runner" now refreshes the unit — update_runner previously only swapped the binary and restarted. It now also re-uploads the systemd unit (same include_str! source as a fresh install) and runs daemon-reload before restart, so unit changes reach already-installed servers.
• Startup migration — migrate_legacy_compose_dirs() runs on boot, moving any leftover /tmp/lockethq-compose-* projects into the persistent location. Uses rename with a recursive copy + delete fallback (tmpfs → disk fails rename with EXDEV). Fully best-effort: errors are logged and skipped so a bad entry never blocks startup.

Also verified (no change needed)

Detection of containers not created by LocketHQ already works: list_containers calls Docker with all: true and no label filter, so every container on the host is returned regardless of who created it, and the frontend renders them all.

Reviewer notes

• The startup migration only helps boxes updated without an intervening restart (older PrivateTmp=true runners already wiped /tmp on restart). The durable fix for everyone is the new unit + new compose location, both delivered by the updated "Update runner" action.
• Both crates build clean; remaining warnings (mut in docker.rs, unused arch field) are pre-existing and unrelated.

🤖 Generated with Claude Code