feat(oci): recover applications after a Proxmox reinstall, cluster records and AMD GPU profiles

The installation record of an OCI application travels with its container:
a copy inside the container and another in /etc/pve, written together
with the one kept on the host. A container restored on a newly installed
Proxmox, restored with another ID or moved to another node of a cluster
is recognised and registered again, with its private network, hookscript,
Rclone mount, host firewall rule and NVIDIA runtime. The Monitor offers
the same recovery from the Updates tab.

AMD GPUs are offered by generation. A GPU the ROCm image supports takes
the profile as it is; one of a supported family (Radeon 680M, 780M) is an
experimental option that asks for confirmation and is never proposed; an
older one is not offered. The GPU is checked with a real inference before
the installation accepts it. Recreate changes what runs recognition in an
installed Immich, between the CPU and a GPU of the host.

Updates:
- A failed update that is restored and checked removes its temporary
  container and the disks of the failed attempt.
- Every container volume is part of the backups, so Jellyfin, Plex and
  Hugo update with their default installation.
- An image published with a Docker-format manifest is recognised by its
  layers and build time and updates.
- The Proxmox notes of a multi-container application link to its LAN
  address.

oci/remote/oci_stack_native.py

@@ -377,6 +377,8 @@ class NativeAdapter:
                         member_tx.run('pct', 'exec', str(vmid), '--', 'python', '-c',
                             'import onnxruntime as ort; '
                             'assert "MIGraphXExecutionProvider" in ort.get_available_providers()')
+                        import oci_rocm_check
+                        oci_rocm_check.check(vmid)
                     if acceleration in ('openvino', 'cuda'):
                         member_tx.run('pct', 'exec', str(vmid), '--', 'python', '-c',
                             'import sys,ctypes,onnxruntime as ort; p=sys.argv[1]; '
@@ -561,7 +563,7 @@ class NativeAdapter:
             record.pop('pending_stack_transaction', None)
             instances.write(instances.location(self.root, vmid), record)
         try:
-            self.release_stages()
+            self.release_stages(recovered=state['phase'] == 'rolled-back')
             if self.keep_backup and state['phase'] == 'committed':
                 import oci_keep_backup
                 for backup in sorted(self.journal.parent.glob('backup-*/vzdump-lxc-*.tar.zst')):
@@ -574,18 +576,25 @@ class NativeAdapter:
         except (OSError, ValueError) as exc:
             member_tx.log(f'cleanup: {exc}')
 
-    def release_stages(self):
-        """The temporary containers that held the data of each member; one
-        that still has a disk attached is kept."""
+    def release_stages(self, recovered=False):
+        """The temporary containers that held the data of each member. When
+        the whole stack was recovered they are removed with the disks of the
+        failed attempt; otherwise one that still has a disk attached is kept."""
+        journals = [(path, True) for path in self.journal.parent.glob('recovery-*/transaction.json')]
         for vmid in self.records:
             folder = instances.location(self.root, vmid).parent / 'transactions'
-            for member_journal in folder.glob('*/transaction.json'):
-                try:
-                    state = json.loads(member_journal.read_text())
-                except (OSError, ValueError):
-                    continue
-                if (state.get('coordinated') or {}).get('journal') == str(self.journal):
-                    member_tx.release_stage(state)
+            journals += [(path, False) for path in folder.glob('*/transaction.json')]
+        for member_journal, own in journals:
+            try:
+                state = json.loads(member_journal.read_text())
+            except (OSError, ValueError):
+                continue
+            if not own and (state.get('coordinated') or {}).get('journal') != str(self.journal):
+                continue
+            if recovered and state.get('phase') == 'rolled-back':
+                member_tx.discard_stage(state)
+            else:
+                member_tx.release_stage(state)
 
     def prune_backups(self, include_current):
         """The backups of closed operations are removed, those of this one