feat(oci): update and modify every application, and keep its address

- The backup taken before an update or a modification is made on another
  storage when it does not fit on the system disk; an operation without
  room says so before anything is stopped.
- Privileged containers, relaxed AppArmor or seccomp, process limits, the
  host monitors Glances and Netdata and single-file host mounts are
  rebuilt and recovered like any other application.
- HAOS One installs the docker-haos image: port 8123, host time zone,
  unprivileged, watchdog proposed by default; it is updated and modified
  with Home Assistant's own check on the rebuilt container.
- A container that reboots itself gets its DHCP client back.
- The installer takes the address of the container's own interface, and
  the notes of a suite or stack container show its LAN address.
- Seerr installs: its volume belongs to the image user and
  no-new-privileges goes through the include of the container.
- Removing an application deletes its seccomp profile.

oci/remote/haos_healthcheck.py

@@ -27,6 +27,9 @@ def note(text):
     """Detail for the run log; without one, for stderr."""
     try:
         if OCI_LOG:
+            if not sys.stderr.isatty():
+                # The progress line goes to a file, which may be this log: end it first.
+                print(file=sys.stderr, flush=True)
             log(OCI_LOG, text)
             return
     except OSError:
@@ -110,7 +113,7 @@ def probe(vmid, ip, remaining):
         raise Pending(translate('Supervisor does not confirm healthy and supported yet'))
     if not http_ready(f'http://{ip}:4357/', max(0.1, min(5, remaining()))):
         raise Pending(translate('Observer is not responding on port 4357'))
-    for port in (80, 8123):
+    for port in (8123, 80):
         if http_ready(f'http://{ip}:{port}/', max(0.1, min(5, remaining()))):
             return [{'label': 'Home Assistant', 'url': f'http://{ip}:{port}/'},
                     {'label': 'Home Assistant Observer', 'url': f'http://{ip}:4357/'}]