stacks: remember where a container's bind mounts pointed

Every stack on core and grid is labelled with a path inside Dockhand's
filesystem — /app/data/stacks/… — because Dockhand ran compose from inside its
own container. Ham Lab resolves those by walking the bind mounts of running
containers, which works right up until the container doing the mounting is
removed. Retiring Dockhand would, in one step, make seventeen stacks on core
and five on grid unfindable.

So the mounts are written down as they are seen, and a path no live container
explains is looked for in what was seen before. A remembered mount resolves
with no container to run in, which is the right answer: compose runs on the
host, against the host's own copy of the file.

The same problem bites a scheduled update, which captures how to invoke
compose when it is made so the cron job never has to rediscover the world at
3am. repoint() checks the named container is still running and falls back the
same way if it is not — and pointedly leaves the spec alone if nothing
explains the path, so it fails loudly rather than deploying a guess.

Out in cron the record is read and never added to: the daemon owns state.json
and would clobber anything written from there.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/hamlab/main.go

@@ -218,7 +218,7 @@ func dockerUpdateJob(cfg *config.Config, id string) error {
 		// A pull that never finishes must not leave a cron job resident until the next reboot.
 		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Hour)
 		defer cancel()
-		out, runErr := api.RunUpdate(ctx, j, api.DockerTool())
+		out, runErr := api.RunUpdate(ctx, st, j, api.DockerTool())
 		rec := storage.RunRecord{At: time.Now(), Taken: j.Stack}
 		if runErr != nil {
 			rec.Error = runErr.Error()