fix(up): start shared-only (hub) workspaces and self-heal the network

[gustavobertoi]

Problem (reported live)

devstack up from a devstack init starter workspace (shared pg/redis/minio, no projects) printed a wall of [ok]/[skipped] but started nothing — no containers, no devstack_shared network:

[ok]      preflight
[skipped] network
[skipped] generate
[ok]      secrets
[ok]      trust
[skipped] shared      <- brought up nothing

Root cause — two drift bugs

1. Hub / shared-only workspaces never came up. Selective-up (spec 12) derives the shared set from projects' uses (profile.sharedUsedBy). A workspace with shared: but no projects has nothing referencing those services, so active.Shared was empty and the shared phase no-op'd. This is exactly what devstack init scaffolds.

2. The network phase was fingerprint-cached with a constant fingerprint, so once satisfied it skipped forever. When the external devstack_shared network was removed out-of-band (a docker network prune, a Docker Desktop / WSL restart), up skipped re-creating it and every compose-up failed with network devstack_shared declared as external, but could not be found.

Fix

• A project-less workspace that declares shared: now brings up its full declared shared stack (sortedSharedNames).
• The network phase is now AlwaysRun: EnsureNetwork is a cheap create-if-missing under the lock, so re-running every time is correct and self-healing.

Verification

Ran against the real reported workspace — network re-created (51ms) and all three shared services came up healthy:

[ok]      network (51ms)
[ok]      shared (10738ms)
devstack-shared-postgres-1   Up (healthy)   5432/tcp
devstack-shared-redis-1      Up (healthy)   6379/tcp
devstack-shared-minio-1      Up (healthy)   9000/tcp

Tests

• TestBuildUpHubWorkspaceBringsUpAllShared — a hub workspace brings up all declared shared services and builds no compose-up phase.
• TestNetworkPhaseSelfHeals — the network re-ensures after out-of-band removal.
• TestBuildUpHappyPath re-run assertion updated: network now re-runs (AlwaysRun) rather than skips.

Known follow-up (not in this PR)

Container-level drift (a manual docker rm of a shared container while config is unchanged) still leaves the shared phase fingerprint-satisfied → skipped. Shared services ship with restart: unless-stopped so restarts self-recover; manual removal is recovered via doctor --fix / shared reconcile. A future change can fold live-container liveness into the shared phase gate.

🤖 Generated with Claude Code