Treat an approved legacy Compose rollout as a transaction

When an explicitly approved legacy Docker Compose deployment must temporarily remain outside the canonical supervisor, make the image-only change transactional. Verify and cache the exact scanned image digest first. Keep registry credentials in a short-lived Docker configuration and remove it before mutating the service. Preserve the complete prior environment file and cached digest, then atomically replace only the image assignment.

If readiness or identity checks fail, automatically restore and recreate the prior service. After the new service passes those checks, use a deterministic fictitious fixture to validate behavior and a strict telemetry privacy allowlist. This limits a temporary exception; it does not make the deployment conform to the canonical supervisor contract.