feat: reconciler plans the start phase

The plan learns the start vocabulary — inert until a caller opts in
(ReconcileOptions.Scope, zero value keeps today's create-only plans
byte-identical):

- OpWaitCondition, one node per (awaited service, condition),
  deduplicated across dependents like networkNodes deduplicates
  networks; required:false marks the shared node best-effort, one
  required dependent upgrades it. service_started needs no node — a
  plain DAG edge to the dependency's chain end expresses it. Health is
  deliberately re-observed at execution time: the plan encodes what to
  wait for, never a stale observation.
- OpRunPreStart, emitted at plan time only when no replica was running
  at observation — the imperative gating — targeting the
  lowest-numbered replica.
- OpRunPostStart per container, after its start.
- replica chains: inject+start+post_start of replica n+1 depends on
  the end of replica n's chain, today's sequential start order made
  visible in golden plans; startChainEnds points at the chain end so a
  service_started dependent waits for the whole service, matching
  InDependencyOrder semantics.
- scope Start plans starting observed exited/created containers
  without converging them (the future compose start); scope
  CreateStart appends the start phase to the create plan, start nodes
  resolving their target from the create node that materializes the
  replica (CreateNodeID, the mechanism OpRenameContainer already
  uses).

Lifecycle parity with the imperative engine is load-bearing and
golden-locked:

- dependency conditions are evaluated even when nothing has to start
  (waitDependencies runs for every visited service before looking at
  what to start), so an up with everything running still fails on an
  unhealthy required dependency;
- an exceptional-state replica takes NO start-phase node: its bare
  create-phase restart leaves it running when the start phase looks, so
  the imperative engine neither re-starts nor injects — and it gates
  pre_start like any running replica;
- startChainEnds carries the end-of-visit node set (waits included when
  nothing started), so a service_started dependent begins only once the
  dependency's whole visit completed, matching InDependencyOrder;
- under scope Start, a scale>0 service with no container at all fails
  the plan with startService's exact error.

The "service:<name>:<number>" resource-ID format is built and parsed in
one place (serviceReplicaID/serviceReplicaPrefix/startGroupID), and the
replica sort deliberately carries the plan's determinism over the
unordered containerNodes iteration.

Golden tests only; no executor support yet and no caller passes the
scope. Epic #14081, Lot 1 — reconciler (first item).

Signed-off-by: Nicolas De Loof <nicolas.deloof@gmail.com>

Author: ndeloof

pkg/compose/plan.go

@@ -53,6 +53,23 @@ const (
 
 	// Provider operations
 	OpRunProvider OperationType = 30
+
+	// Start-phase operations
+	OpWaitCondition OperationType = 40
+	OpRunPreStart   OperationType = 41
+	OpRunPostStart  OperationType = 42
+)
+
+// PlanPhase situates a node in the plan lifecycle. The Create phase converges
+// resources and containers to their desired shape; the Start phase brings
+// containers to running — dependency waits, pre_start hooks, starts,
+// post_start hooks. The zero value is Create, so plans built before the start
+// phase existed render unchanged.
+type PlanPhase int
+
+const (
+	PhaseCreate PlanPhase = iota
+	PhaseStart
 )
 
 // String returns the human-readable name of an OperationType.
@@ -82,6 +99,12 @@ func (o OperationType) String() string {
 		return "RenameContainer"
 	case OpRunProvider:
 		return "RunProvider"
+	case OpWaitCondition:
+		return "WaitCondition"
+	case OpRunPreStart:
+		return "RunPreStart"
+	case OpRunPostStart:
+		return "RunPostStart"
 	default:
 		return fmt.Sprintf("Unknown(%d)", int(o))
 	}
@@ -102,7 +125,8 @@ type Operation struct {
 	Network      *types.NetworkConfig // for network operations
 	Volume       *types.VolumeConfig  // for volume operations
 	Timeout      *time.Duration       // for stop operations
-	CreateNodeID int                  // for OpRenameContainer: ID of the CreateContainer node whose result to rename
+	CreateNodeID int                  // for OpRenameContainer/start-phase ops: ID of the CreateContainer node whose result to target
+	Condition    string               // for OpWaitCondition: depends_on condition to wait for (service_healthy, ...)
 	// BestEffort marks an operation whose failure must not abort the plan. It is
 	// used for the optional removal of the old network on a rename: if the
 	// network is still in use (by non-Compose containers) the removal is skipped
@@ -118,6 +142,7 @@ type PlanNode struct {
 	Operation Operation
 	DependsOn []*PlanNode // prerequisite operations
 	Group     string      // event grouping key (e.g. "recreate:web:1"); empty for ungrouped nodes
+	Phase     PlanPhase   // lifecycle phase this node belongs to; zero is Create
 }
 
 // Plan is a directed acyclic graph of operations produced by the reconciler.
@@ -171,6 +196,9 @@ func (p *Plan) String() string {
 		if node.Group != "" {
 			fmt.Fprintf(&sb, " [%s]", node.Group)
 		}
+		if node.Phase == PhaseStart {
+			sb.WriteString(" {start}")
+		}
 		sb.WriteByte('\n')
 	}
 	return sb.String()