deploy(gw-04): running-container drift check + docker-compose v1 fallback

Two fixes needed to make the timer actually roll correctly on gw-04:

1. Drift check compares the running container's image ID against the
   local `clawmates/<svc>:latest` tag, not just pre/post-pull digests.
   The pre/post check only catches new pulls — if a previous roll failed
   between the retag and `docker compose up` (e.g. compose CLI failed),
   the tag was updated but the container wasn't, and the next tick saw
   no drift and silently left the stale container running. The
   running-vs-tag check catches that case on the next tick.

2. Prefer `docker compose` (v2 plugin) but fall back to legacy
   `docker-compose` (v1). GW-04 ships v1 only right now, and calling
   `docker compose up -d` failed with "unknown shorthand flag: 'd'"
   because docker had no `compose` subcommand at all. The fallback
   keeps the script portable when the stack moves to a host with v2.

deploy/gw-04/clawmates-deploy.sh

@@ -35,21 +35,29 @@ for svc in "${SERVICES[@]}"; do
   ref="${REGISTRY}/${NAMESPACE}/${svc}:latest"
   local_ref="${NAMESPACE}/${svc}:latest"
 
-  before=$(docker inspect --format '{{.Id}}' "$ref" 2>/dev/null || echo "")
   if ! docker pull -q "$ref" >/dev/null 2>&1; then
     log "pull failed: $ref"
     continue
   fi
-  after=$(docker inspect --format '{{.Id}}' "$ref")
 
-  if [[ "$before" != "$after" ]]; then
+  # Keep the un-prefixed tag pointing at the fresh image so the compose file
-    log "new image for $svc: ${before:-<none>} -> $after"
+  # (which references clawmates/<svc>:latest) picks up the new image on `up`.
+  docker tag "$ref" "$local_ref"
+
+  # True drift check: is the running container's image ID the same as what
+  # `clawmates/<svc>:latest` now points to? Comparing pre/post pull digests
+  # only catches new pulls — if a previous roll failed after the retag but
+  # before `up`, the tag was updated but the container wasn't. This catches
+  # that case on the next run.
+  target=$(docker inspect --format '{{.Id}}' "$local_ref")
+  cid=$(docker ps -q --filter "name=clawmates_${svc}_1")
+  running=""
+  [ -n "$cid" ] && running=$(docker inspect --format '{{.Image}}' "$cid")
+
+  if [[ "$running" != "$target" ]]; then
+    log "$svc drift: running=${running:-<none>} target=$target"
     changed+=("$svc")
   fi
-
-  # Always keep the un-prefixed tag pointing at the fresh image, so a stale
-  # local retag can't wedge us.
-  docker tag "$ref" "$local_ref"
 done
 
 if [[ ${#changed[@]} -eq 0 ]]; then
@@ -58,5 +66,12 @@ fi
 
 log "rolling: ${changed[*]}"
 cd "$COMPOSE_DIR"
+# Prefer `docker compose` (v2 plugin); fall back to legacy `docker-compose`
+# (v1). GW-04 currently ships v1 only; this makes the script portable if we
+# ever move the stack to a host with the plugin.
+if docker compose version >/dev/null 2>&1; then
   docker compose up -d "${changed[@]}"
+else
+  docker-compose up -d "${changed[@]}"
+fi
 log "roll complete: ${changed[*]}"