feat(oci): support custom Compose workers and migration jobs

oci/README.md

@@ -209,7 +209,55 @@ The native path checks the saved configuration and installation identity, keeps
 
 ## From a Compose file or a docker run command to an oci-compose
 
-The converter reads Compose files with one or several services. Multi-service files use the same native stack compiler as catalog applications: each service runs in its own LXC, with dependency ordering and private networking. The first service that publishes a port is selected as the main service, unless `x-casaos.main` specifies another one. Every image is checked for registry access before installation, and written tags and digests are preserved. Each web application uses its own published container port for its health check and receives its own LAN address. Repeated identical volume sources share one host directory, whose location is selected once; separate configuration volumes remain independent. Unsupported stack features (including external networks and application services without a supported health check) are reported before installation. A `docker run` command and an image reference alone are first written as a Compose file and follow the same path, so the three produce the same kind of oci-compose.
+The converter reads Compose files with one or several services. Multi-service
+files use the native stack compiler: each service runs in its own LXC, with
+dependency ordering and a private network. The first service that publishes a
+port is selected as the main service, unless `x-casaos.main` selects another one.
+Every image is checked for registry access before installation; written tags,
+digests and image entrypoints are preserved.
+
+The file importer resolves an explicitly selected project `.env` and service
+`env_file` files, then applies Compose interpolation and service overrides. It
+does not silently import the host process environment. Missing required values
+are requested before installation, and summaries hide secret values. An inline
+Compose definition can also supply an environment file or enter values through
+the assistant.
+
+Published web services receive individual LAN addresses. The main web check uses
+the same LAN URL shown to the user; private backend aliases stay on the internal
+network. Internal services can use declared or inherited image health checks,
+exposed TCP ports, or a clearly labelled process-running check. A running process
+alone does not satisfy `service_healthy`.
+
+Repeated identical volume sources share one host directory, selected once;
+separate configuration volumes stay independent. Host directories are not part
+of a normal Proxmox container backup. Newly created private data volumes use the
+imported image user unless an explicit volume owner or PUID/PGID overrides it.
+SELinux `z`/`Z` labels are reported as not applied on a non-enforcing host; an
+enforcing host is refused rather than silently losing their protection.
+
+An explicit Compose `stop_signal` overrides the image's stop signal through
+`lxc.signal.halt`. Without it, the image signal stays unchanged, including when
+Compose replaces its entrypoint. A worker sharing a web image may therefore
+need its own declared stop signal. Native updates abort safely if a service
+does not stop; they do not silently force termination to replace its disks.
+Some programs ignore termination signals when running as PID 1. Setting a signal
+does not add an init process or guarantee graceful shutdown; an explicit
+`SIGKILL` requests forced termination, not a graceful stop.
+
+A dependency declared with `service_completed_successfully` runs as a one-shot
+job. Its original command must finish with a verified exit code of zero before
+the dependent service starts. Such jobs are excluded from onboot and watchdog
+restarts. Update and restore invalidate the completion proof when the image,
+runtime configuration or recovery identity changes. A migration update is
+refused when database or unclassified backend data lives in host directories
+that the transaction cannot safely restore.
+
+The bridges are local to the installation node; they are not a cluster SDN.
+Unsupported network and runtime semantics are reported before installation.
+Support for several services does not imply complete Docker Compose compatibility.
+A `docker run` command or image reference is converted to Compose first and
+follows the same importer.
 
 Starting from this definition: