deploy(gw-04): drop the un-prefixed retag bridge

The compose file on gw-04 was migrated to registry-prefixed image
references (100.94.185.103:5000/clawmates/<svc>:latest), which lets
`docker compose up` pick up the pulled image directly. The old script
retagged each pulled image to `clawmates/<svc>:latest` as a bridge so
the previous compose file (which used bare names) would find it —
that step is now unnecessary and just added a small window where the
un-prefixed tag could diverge from the registry.

Drift check now compares against the registry-prefixed tag directly.
`docker compose` v2 preferred with `docker-compose` v1 fallback stays.

deploy/gw-04/clawmates-deploy.sh

@@ -1,9 +1,14 @@
 #!/usr/bin/env bash
 #
 # clawmates rolling deploy — polls the fleet registry for :latest of the three
-# prod images (broker, server, frontend). On drift, pulls the new image, retags
+# prod images (broker, server, frontend). On drift, pulls the new image and
-# it under the un-prefixed name the running compose file uses, and rolls the
+# rolls the affected services with `docker compose up -d`.
-# affected services with `docker compose up -d`.
+#
+# The compose file must reference the registry-prefixed image names
+# (100.94.185.103:5000/clawmates/<svc>:latest) so `up` picks up the pulled
+# image directly. Previous versions of this script retagged to un-prefixed
+# names as a bridge; that step is retired now that the compose file points
+# at the registry directly.
 #
 # Install:
 #   sudo install -m 0755 clawmates-deploy.sh /usr/local/bin/clawmates-deploy.sh
@@ -15,10 +20,6 @@
 # Verify:
 #   systemctl list-timers clawmates-deploy.timer
 #   tail -f /var/log/clawmates-deploy.log
-#
-# The retag step (registry/clawmates/<svc>:latest → clawmates/<svc>:latest)
-# keeps the current /root/clawmates/docker-compose.yml working unchanged until
-# we're ready to migrate the compose file to registry-prefixed image names.
 
 set -euo pipefail
 
@@ -33,23 +34,17 @@ log() { printf '%s %s\n' "$(date -Iseconds)" "$*" | tee -a "$LOG" >/dev/null; }
 changed=()
 for svc in "${SERVICES[@]}"; do
   ref="${REGISTRY}/${NAMESPACE}/${svc}:latest"
-  local_ref="${NAMESPACE}/${svc}:latest"
 
   if ! docker pull -q "$ref" >/dev/null 2>&1; then
     log "pull failed: $ref"
     continue
   fi
 
-  # Keep the un-prefixed tag pointing at the fresh image so the compose file
+  # Drift check: does the running container's image ID match what
-  # (which references clawmates/<svc>:latest) picks up the new image on `up`.
+  # `$ref` (the registry-prefixed :latest) now points to? Catches both
-  docker tag "$ref" "$local_ref"
+  # a fresh pull AND the case where a previous roll failed after pull
-
+  # but before `up` — the tag was updated but the container wasn't.
-  # True drift check: is the running container's image ID the same as what
+  target=$(docker inspect --format '{{.Id}}' "$ref")
-  # `clawmates/<svc>:latest` now points to? Comparing pre/post pull digests
-  # only catches new pulls — if a previous roll failed after the retag but
-  # before `up`, the tag was updated but the container wasn't. This catches
-  # that case on the next run.
-  target=$(docker inspect --format '{{.Id}}' "$local_ref")
   cid=$(docker ps -q --filter "name=clawmates_${svc}_1")
   running=""
   [ -n "$cid" ] && running=$(docker inspect --format '{{.Image}}' "$cid")