fix(cloud): shared-localstack health gate + db-create connect race

[gustavobertoi]

Two runtime bugs surfaced while exercising the cloud/resource stack live on WSL2. Both were invisible to the existing unit/golden tests because nothing drove these commands against a real daemon — the follow-up e2e pipeline (release gate) will.

1. shared-localstack unhealthy → up aborts

Symptom: up fails with service "shared-localstack" ... is unhealthy after 1 attempt(s) even though LocalStack logs Ready.

Root cause: LocalStack 3.x reports each configured SERVICES entry as "available" on startup; a service only flips to "running" after its first request. The healthcheck greps solely for running, so it never matches on a fresh engine — the container is permanently unhealthy, and the up saga's health gate correctly aborts. It's a deadlock: nothing is running until traffic arrives, but traffic can't arrive until the engine is up.

Fix: gate on available|running (edge up + providers loaded). Verified against the live container: new check exits 0, old exits 1.

• templates/localstack/template.yaml healthcheck updated
• templates/localstack/golden.yaml regenerated through the real render path (only the healthcheck line changes)
• regression test TestLocalStackHealthGatesOnAvailable

2. db create → connection reset by peer on 127.0.0.1:45432

Symptom: db create <name> fails with connect to shared postgres on 127.0.0.1:45432: ... read: connection reset by peer.

Root cause: a readiness race. The imperative resource path (and the saga provision phase) publishes the engine's host port via an up-time compose overlay; compose up -d recreates the container to bind it. For ~1–2s the Docker userland proxy accepts the TCP connection but Postgres isn't listening yet, so it RSTs the handshake. A single immediate connect loses the race.

Fix: retryingPgConnect — a capped-backoff retry (30s budget) around the admin connect that retries only transient just-restarted errors (reset / refused / EOF / "starting up") and fails fast on real errors (bad creds, unknown db). Wired into both the imperative registry and the saga provision phase. Unit + race tested with an injected clock/connector (no live server needed).

Tests

• internal/generate: golden + determinism green; new localstack regression test
• internal/orchestrate: 6 new tests for the retry (classification, eventual success, fail-fast, budget bound, ctx cancel, nil passthrough) + -race
• touched-package suites (orchestrate, generate, cli) all green

🤖 Generated with Claude Code