Profile-deactivation hardening: compose-file drift guard for the service map + reverse-switch coverage

[VijitSingh97]

Two residuals from the adversarial pass on #804's merged fix (posted there as a comment, now tracked):

1. Drift guard: remove_deactivated_profile_containers hardcodes the service↔profile map. A future profile-gated service added to docker-compose.yml silently escapes removal. Add a stack-tier assertion that enumerates profiles: from the compose file and fails when the map misses one — same pattern as tier 1: assert the compose depends_on graph (edges + conditions) #565's depends_on count guard.
2. Reverse-switch coverage: the stack tests prove local→remote removes the container; nothing drives remote→local in the same apply and asserts the freshly-reactivated profile's container comes up. The code path reads correct; one black-box case pins it.

🤖 Generated with Claude Code

[VijitSingh97]

PR up: #826 — drift guard in tests/stack/test_compose.sh (compose --profile '*' enumeration diffed against the map parsed from the script, negative-tested) plus the tari remote→local reverse-switch black-box case in tests/stack/run.sh. Full stack suite 1696/0, lint clean.

🤖 Generated with Claude Code