fix(collector): label-based fleet container discovery

The events watcher's start-event filter previously called
_load_service_container_names(), which reads decnet-state.json on
every event. decnet deploy writes that state file out-of-band
with docker compose up, so a container's start event could
arrive before the state was committed — the watcher then dropped
the event silently and never tailed the container's stdout. The
visible symptom was an empty Credentials view (and Logs/Bounty)
after a fresh deploy until the collector was manually restarted.

Fix: stamp decnet.fleet.{service,decky,service_name} labels on
every fleet service container at compose-time, and let the
collector recognize either the fleet or topology label without
touching the state file. The state-file name match remains as a
fallback for legacy containers that predate the new labels.

decnet/composer.py

@@ -91,6 +91,19 @@ def generate_compose(config: DecnetConfig) -> dict:
             # Rotate Docker logs so disk usage is bounded
             fragment["logging"] = _DOCKER_LOGGING
 
+            # Stamp DECNET ownership labels so the collector's docker-events
+            # watcher can identify newly-started containers without consulting
+            # decnet-state.json (which is written and read out-of-band with
+            # `docker compose up`, leaving a race window where freshly started
+            # containers were silently ignored).
+            labels = dict(fragment.get("labels") or {})
+            labels.update({
+                "decnet.fleet.service": "true",
+                "decnet.fleet.decky": decky.name,
+                "decnet.fleet.service_name": svc_name,
+            })
+            fragment["labels"] = labels
+
             services[f"{decky.name}-{svc_name}"] = fragment
 
     # Network definitions