refactor: name things once, and say the rest in code

[ttncode]

What this changes

Two things, in two commits.

fix(install) — a real defect this pass turned up. common/install.sh
decided whether a stack had a migrate service with

docker compose --profile migrate config --services | grep -qx migrate

grep -q exits on its first match and closes the pipe; docker compose then
dies of SIGPIPE, and set -o pipefail reports the whole pipeline as failed.
Measured 6 failures in 40 runs against a real generated stack. The effect on
a client: roughly one install.sh run in seven refuses to migrate with
"a database service exists but no migrate service was found — refusing to start
with unapplied schema", about a service that is sitting right there. This ships
into every generated project. compose_has_service captures the list first and
matches against it — 0 failures in 40 after.

refactor — the rest. No behaviour change intended anywhere else.

• A header block on every script, in one format.
• Functions grouped by prefix, with section rules between groups.
• One vocabulary for verbs: assert_ dies on a bad value (9), require_ is an
  environment precondition (3), resolve_ works a value out (5), record_
  writes it down (4), load_ reads a definition into variables (4), print_
  only prints (3), a bare noun is a getter. Twelve functions were renamed to fit
  it, including three whose names said the wrong thing:
  resolve_minimum_release_age → record_release_age_exceptions (it records,
  it never resolved), and the near-identical verify_workspace_filter_name /
  resolve_workspace_filter_name → assert_workspace_filter_name /
  substitute_workspace_filter.
• Long functions split into named steps: cmd_new 143 → 27 lines, and the same
  for cmd_add, cmd_update, cmd_publish, lint_adapters, lint_services,
  apply_service_drivers. scripts/deploy-check.sh and
  scripts/check-provenance.sh were straight-line scripts; both are now a
  main calling named steps. 126 → 187 functions, longest 143 → 69 lines.
• Duplicated code pulled into one place: merge_compose_fragment replaces four
  copies of the same yq-merge-or-die block, adapter_env_value four copies of
  the same sed, relax_pnpm_workspace/restore_pnpm_workspace three copies of
  the same three-line sed, resolve_project two copies of a ten-line block.
• Named constants for hard-coded values: FIRST_APP_PORT/APP_CONTAINER_PORT
  (which removed the magic 8079 and the paragraph explaining it),
  PNPM_RELAXATIONS, PUBLISH_UNSUPPORTED, SHARED_DRIVERS_DIR,
  PasswordPlaceholder, ESC_SEQUENCE_TIMEOUT, and others.
• Comments cut where the code already said it: 18,505 → 13,166 words (-29%),
  36% → 27% of lines. Fourteen were pure signature echoes and are gone; the rest
  were compressed, not deleted — what is left is third-party landmines
  (mise exec trusting a parent config, pnpm turning on frozen lockfiles under
  CI, yq collapsing a document without -P).
• Three docs pointed at functions that had moved to lib/manifest.sh; fixed.

Not done, deliberately: readonly on the constants. These libraries are
re-sourced into child processes by design, and a second readonly is an error
that set -e turns into a dead script. immich uses readonly in none of its
shell scripts either.

How it was verified

• mise run lint — clean.
• mise run test-runner — both lanes under the runner's own environment.
• mise exec -- bats tests/provenance.bats — 4/4.
• mise exec -- zizmor --min-severity medium .github/workflows/ — no findings.
• ./scripts/deploy-check.sh nextjs nestjs --db postgres against real Docker —
  two images built, both containers healthy, liveness 200, readiness 200,
  migrations applied. Run three times over this branch; the one red run is what
  found the SIGPIPE bug above.
• The SIGPIPE fix itself: the failing pipeline measured at 6/40, the replacement
  at 0/40, against a generated nextjs+nestjs+postgres project.
• Every function name before and after was diffed: nothing was lost, twelve were
  renamed, the rest are new splits.

Checklist

• mise run lint passes
• mise run test-runner passes
• New behaviour has a test that fails without the change
• Docs that describe changed behaviour were updated in the same commit
• No unrelated changes