fix: Correlate planned Docker stops before reporting crashes

[rdwr-egore]

Purpose

Fix misleading CRITICAL crash / OOM guidance when Docker explicitly requests a container stop, but the application ignores SIGTERM and is eventually killed with exit 137. A SIGKILL exit is not evidence of OOM.

Scope after holistic PR integration

• Rebased on merged PRs fix: Rate-limit removed container event warnings and resolve by ID #6 (immutable Docker identity and missing-event cache) and fix: Deduplicate restart-loop alerts and require stable recovery #5 (authoritative RestartCount, one incident, stable recovery).
• Keep a small, bounded stop/die correlator (3 seconds default). Docker stop events sometimes precede and sometimes follow die.
• A confirmed stop suppresses only the corresponding misleading CRASH; direct docker kill or nonzero exit without stop evidence remains CRITICAL. OOM continues to take precedence.
• Docker start separates successive runs, so a later stop cannot excuse an earlier failure from the same container ID.
• CRASH/OOM/RESTART-LOOP and RECOVERED still use PR fix: Deduplicate restart-loop alerts and require stable recovery #5's single incident engine. No second restart counter, cooldown, state machine, or alert dispatcher.
• Correct exit 137 runbook guidance. Optional disable switch: lifecycle_detection.enabled=false.
• Retain the existing ID-based missing-container handling from PR fix: Rate-limit removed container event warnings and resolve by ID #6.

Explicitly deferred

• Expected-running / sustained-down availability alerts and a new not-running incident type.
• Optional INFO alerts for ordinary Docker stops.
• HA-specific planned service shutdown suppression (separate from HA PR feat: Optional HA active-node change alert (draft) #4).

These were removed to keep the correctness fix focused.

Validation

• 76 combined Python regression tests pass in the existing watchdog runtime image.
• Real Docker Engine tests on m920q with isolated observer and no production notification channels:
  • docker stop with ignored SIGTERM -> exit 137, OOMKilled=false -> no CRASH.
  • unexpected exit code 2 -> one CRASH.
  • direct SIGKILL -> exit 137 -> one CRASH.
  • memory-cgroup OOM -> exit 137, OOMKilled=true -> one OOM only.
  • six automatic restarts -> one CRASH + one RESTART-LOOP.
• Additional unit coverage: stop before/after die, wrong container ID, stop after the correlation window, later-run stop not hiding an earlier failure, OOM arrival order, delayed events after recovery, and name reuse.
• Disposable test containers removed; running production watchdog not modified.
• Full Dockerfile dependency build on m920q could not run with network disabled. GitHub CI performs the actual image build.

Important limits

A Docker stop event establishes a Docker-requested stop, not authorization. A missing or late stop event is treated conservatively as an unexpected crash. This PR does not prove that a stopped critical service should remain down.

Merge gate

Keep draft until GitHub CI (tests and Docker build) passes and compatibility with draft HA PR #4 is checked.