fix(deploy): use approved container diagnostics

[mustafazeydani]

Summary

• replace forbidden generic Docker inspect calls with approved container-list diagnostics
• use the fixed non-secret Compose status projection for health and status checks
• add deployment contract coverage to prevent regressions

Verification

• pnpm validate
• remote read-only verification of the approved container and Compose diagnostics