Add supabase stack + general compose runner

Adds "a stack whose default is a substrate": a shared self-hosted Supabase
backend plus a `--stack supabase` that scaffolds per-app projects (migrations +
edge functions + static UI) which deploy against it. Apps own their code and
stay repo-durable; only their rows/blobs live on the shared substrate.

- compose runner: new RunCompose supervises a multi-container stack as one
  systemd unit (ExecStart=`compose up`, generated ExecStop=`compose down`);
  secrets via EnvironmentFile. Reusable beyond Supabase. Deployment.stop_cmd
  carries the teardown command through the registry.
- supabase stack: CLI --stack choice, STACK_DEFAULTS→frontend with
  build.outputs=[public], _scaffold_supabase() (migrations/RLS/functions/
  static UI/app manifest), and SupabaseHandler with a forward-only idempotent
  migration runner (plan_migrations + psql build) and deno dev-verbs.
- docs: docs/stacks/supabase.md, registered in CLAUDE.md; compose runner
  documented in registry.md.
- tests: compose run/stop cmd, systemd ExecStop, compose host-route TLS,
  migration planner, supabase verb resolution, create --stack supabase.

core/tests/test_systemd.py

@@ -124,6 +124,25 @@ class TestUnitFromDeployed:
         unit = generate_unit_from_deployed("my-svc", deployed)
         assert "/data/repos/" not in unit
 
+    def test_exec_stop_emitted_for_compose(self) -> None:
+        """A compose deployment's stop_cmd becomes ExecStop= (clean teardown)."""
+        deployed = Deployment(
+            runner="compose",
+            run_cmd=["/usr/bin/docker", "compose", "-p", "castle-x", "-f", "c.yml", "up"],
+            stop_cmd=["/usr/bin/docker", "compose", "-p", "castle-x", "-f", "c.yml", "down"],
+            description="Stack",
+        )
+        unit = generate_unit_from_deployed("x", deployed)
+        assert "ExecStop=/usr/bin/docker compose -p castle-x -f c.yml down" in unit
+
+    def test_no_exec_stop_without_stop_cmd(self) -> None:
+        """Runners without a stop_cmd rely on SIGTERM — no ExecStop line."""
+        deployed = Deployment(
+            runner="python", run_cmd=["/uv", "run", "x"], description="X"
+        )
+        unit = generate_unit_from_deployed("x", deployed)
+        assert "ExecStop=" not in unit
+
 
 class TestSecretEnvFile:
     """Secrets are referenced via EnvironmentFile=, never inlined."""