Add supabase stack + general compose runner

Adds "a stack whose default is a substrate": a shared self-hosted Supabase
backend plus a `--stack supabase` that scaffolds per-app projects (migrations +
edge functions + static UI) which deploy against it. Apps own their code and
stay repo-durable; only their rows/blobs live on the shared substrate.

- compose runner: new RunCompose supervises a multi-container stack as one
  systemd unit (ExecStart=`compose up`, generated ExecStop=`compose down`);
  secrets via EnvironmentFile. Reusable beyond Supabase. Deployment.stop_cmd
  carries the teardown command through the registry.
- supabase stack: CLI --stack choice, STACK_DEFAULTS→frontend with
  build.outputs=[public], _scaffold_supabase() (migrations/RLS/functions/
  static UI/app manifest), and SupabaseHandler with a forward-only idempotent
  migration runner (plan_migrations + psql build) and deno dev-verbs.
- docs: docs/stacks/supabase.md, registered in CLAUDE.md; compose runner
  documented in registry.md.
- tests: compose run/stop cmd, systemd ExecStop, compose host-route TLS,
  migration planner, supabase verb resolution, create --stack supabase.

core/tests/test_resolution.py

@@ -2,8 +2,48 @@
 
 from __future__ import annotations
 
+from pathlib import Path
+
 from castle_core.manifest import ProgramSpec
-from castle_core.stacks import _declared_commands, available_actions, is_available
+from castle_core.stacks import (
+    _declared_commands,
+    _migration_version,
+    available_actions,
+    is_available,
+    plan_migrations,
+)
+
+
+class TestMigrationPlanner:
+    """The supabase stack's forward-only, idempotent migration runner (pure part)."""
+
+    def test_version_is_leading_token(self) -> None:
+        assert _migration_version(Path("0007_add_users.sql")) == "0007"
+
+    def test_orders_by_filename_and_skips_applied(self) -> None:
+        files = [Path("0003_c.sql"), Path("0001_a.sql"), Path("0002_b.sql")]
+        pending = plan_migrations(files, {"0001"})
+        assert [p.name for p in pending] == ["0002_b.sql", "0003_c.sql"]
+
+    def test_none_pending_when_all_applied(self) -> None:
+        files = [Path("0001_a.sql"), Path("0002_b.sql")]
+        assert plan_migrations(files, {"0001", "0002"}) == []
+
+    def test_all_pending_on_fresh_db(self) -> None:
+        files = [Path("0002_b.sql"), Path("0001_a.sql")]
+        assert [p.name for p in plan_migrations(files, set())] == [
+            "0001_a.sql",
+            "0002_b.sql",
+        ]
+
+
+class TestSupabaseStackResolution:
+    def test_supabase_stack_resolves_verbs(self) -> None:
+        """A supabase program resolves build (migrations) + deno verbs."""
+        p = ProgramSpec.model_validate({"source": "/tmp/x", "stack": "supabase"})
+        actions = available_actions(p)
+        assert "build" in actions and "test" in actions
+        assert "install" in actions and "uninstall" in actions
 
 
 class TestResolution: