Add supabase stack + general compose runner

Adds "a stack whose default is a substrate": a shared self-hosted Supabase
backend plus a `--stack supabase` that scaffolds per-app projects (migrations +
edge functions + static UI) which deploy against it. Apps own their code and
stay repo-durable; only their rows/blobs live on the shared substrate.

- compose runner: new RunCompose supervises a multi-container stack as one
  systemd unit (ExecStart=`compose up`, generated ExecStop=`compose down`);
  secrets via EnvironmentFile. Reusable beyond Supabase. Deployment.stop_cmd
  carries the teardown command through the registry.
- supabase stack: CLI --stack choice, STACK_DEFAULTS→frontend with
  build.outputs=[public], _scaffold_supabase() (migrations/RLS/functions/
  static UI/app manifest), and SupabaseHandler with a forward-only idempotent
  migration runner (plan_migrations + psql build) and deno dev-verbs.
- docs: docs/stacks/supabase.md, registered in CLAUDE.md; compose runner
  documented in registry.md.
- tests: compose run/stop cmd, systemd ExecStop, compose host-route TLS,
  migration planner, supabase verb resolution, create --stack supabase.

CLAUDE.md

@@ -44,6 +44,7 @@ Stack guides (for writing *new* code, AI-facing):
 - @docs/stacks/python-fastapi.md — FastAPI service patterns (config, routes, models, testing)
 - @docs/stacks/python-cli.md — CLI tool patterns (argparse, stdin/stdout, piping, testing)
 - @docs/stacks/react-vite.md — React/Vite/TypeScript frontend patterns
+- @docs/stacks/supabase.md — Database-backed apps on the shared Supabase substrate (migrations, RLS, edge functions)
 
 ### Quick start
 
@@ -64,8 +65,8 @@ castle program add https://github.com/me/widget.git --name widget
 ```
 
 `castle program create` scaffolds under `/data/repos/` (override with
-`CASTLE_REPOS_DIR`) and registers the program in `castle.yaml` with an absolute
-`source:`. `castle program add` registers an existing repo in place (or records
+`CASTLE_REPOS_DIR`) and registers the program under `programs/<name>.yaml` with an absolute
+`source:`. `castle program add` registers an existing repo in place under `programs/<name>.yaml` (or records
 its `repo:` URL for `castle program clone`).
 
 ## Castle CLI