fix(cli): make Unix restart recreate containers

[tang-vu]

Why this matters

On Linux and macOS, ods restart [service] currently delegates to docker compose up -d without --force-recreate. Compose leaves an already-running, unchanged container untouched, so the command can report ?restarted? while the process was never restarted. It also leaves environment values captured at container creation stale after an operator edits .env or a lifecycle step updates model routing.

This makes both Unix CLIs use up -d --force-recreate --no-build --pull never for single-service and all-service restarts. The service selection and native Apple Silicon llama lifecycle stay unchanged. --no-build --pull never makes restart consume only already-installed release images; Linux contributors can still opt into the existing --rebuild-images path, which builds before recreation.

Behavioral invariant: a successful restart replaces every selected Compose container with its current configuration and local pinned image, without implicitly building or pulling artifacts.

Overlap check

Searched open and closed PRs for macOS restart force recreate, ods-macos restart environment, restart force-recreate, and restart env-backed containers, plus open issues for restart no-op/environment behavior. No open or closed PR covers the Linux/macOS paths.

The historical Windows change carried in closed #1724 established this same invariant for ods.ps1 and added the Windows contract; it did not modify ods/ods-cli or ods/installers/macos/ods-macos.sh. This PR completes platform parity without touching the already-hardened Windows implementation.

Regression test

tests/test-unix-restart-recreate-env.sh invokes the real Linux and macOS CLI boundaries twice each: once for restart dashboard and once for restart with no service. A Docker fixture records the public Compose command and requires force recreation, no build, no pull, the persisted compose flags, and the correct selected service set.

The test reproduces the previous command before the fix as up -d [dashboard], which does not guarantee any restart.

Validation

• bash tests/test-unix-restart-recreate-env.sh ? passed for Linux and macOS, single/all service cases
• bash tests/test-macos-bootstrap-resume.sh ? passed
• bash tests/test-ods-cli-pipefail-tolerance.sh ? 16 passed, 0 failed, 0 skipped
• make lint ? passed
• git diff --check ? passed

No live containers were recreated during validation; the boundary fixture verifies Compose orchestration. Rollback restores the old no-op-prone up -d behavior and does not require a data migration.

Batch compatibility

This PR was validated on synthetic integration head 9af795fc, which applies #3158 through #3167 in numeric order on upstream/main (6ff9b4fc). Combined make lint, make test, make smoke, make simulate, and all 418 BATS cases passed (one root-specific permission assertion skipped by design).

Recommended merge order: #3158 ? #3159 ? #3160 ? #3161 ? #3162 ? #3163 ? #3164 ? #3165 ? #3166 ? #3167. The only manual reconciliation observed was the adjacent Makefile test insertion shared by #3164 and #3166; retain both test-unix-restart-recreate-env.sh and test-chat-error-exit-parity.sh lines. Production code merged automatically across the full batch.