Attach persistent identity storage before first proxy start

Attach persistent identity storage before the first start of a stateful proxy or agent. If an image-backed service auto-starts before its volume is attached, the first replica can enroll using ephemeral state and its replacement can enroll again from persistent state, leaving a stale duplicate identity. Prefer an operation that creates the service and volume before startup, or stage a source-less or zero-replica service, attach storage and configuration, and only then perform the first deployment. A healthy replacement does not itself remove the stale enrollment.