add Phase 2A container and recovery readiness gates

docs/le-app-database-migration/phase2a-host-maintenance/container-disposition/README.md

@@ -0,0 +1,29 @@
+# Reviewed Docker container disposition
+
+Source: root-created, checksum-verified read-only baseline
+`/tmp/le-phase2a-container-baseline.HyAW6sPg`, captured 2026-07-12 without
+container environments, mounts, secret files, or credentials.
+
+The baseline contains 88 containers: 87 running, one intentionally stopped, and
+one unhealthy. `sonarr` is the sole reviewed unhealthy running container. Its
+exact container ID, image reference and image ID, running/health state, startup
+timestamp, network mode, restart policy, Compose project, and hash of its health
+check definition are in `sonarr-unhealthy.allowlist.psv`. The operator verified
+that its `/config/config.xml` is empty, no listener exists on port 8989, and its
+health check fails. Sonarr is unrelated to Phase 2A and need not be repaired.
+Any identity change, unexpected state, or additional unhealthy container is a
+hard stop before maintenance.
+
+`directus` is the sole stopped container. It is retired and must remain stopped;
+its exact identity is in `directus-stopped.allowlist.psv`. Starting, recreating,
+replacing, or changing its recorded state invalidates preflight.
+
+`running-containers.psv` is the authoritative 87-container post-reboot baseline.
+Containers recorded healthy must return healthy. Containers without health
+checks must return running. Sonarr must remain present and running; its health
+may remain unhealthy or improve to healthy. It may not become missing, stopped,
+restarting, or dead. No script starts, restarts, or recreates a container.
+
+The running `castopod` and `castopod-redis` containers have restart policy `no`.
+If either fails to return after reboot, validation records explicit operator
+attention and fails without starting it automatically.