fix(ops): caddy cannot run on the co-tenant box, so stop starting it #5565

The problem

caddy binds host :80/:443. On the 161 box Coolify's Traefik owns both, so every compose up left a caddy container stuck in Created and returned non-zero.

That much was known and tolerated. The cost was not:

$COMPOSE up -d --remove-orphans || echo "... (likely the co-tenant caddy port conflict) — continuing to app health gate"

The excuse was correct on every single tick, which is what makes it useless — a genuine compose failure arrived pre-explained and read as routine. Same shape as the rest of this week's findings: a signal that is always firing is not a signal.

The fix

Remove the cause instead of apologising for it. scripts/docker-compose.coolify-override.yml now puts caddy behind a dedicated-edge profile that nothing activates, so the co-tenant stack is gluecron + autoheal.

• Dedicated hosts are unchanged — they never layer that override, so caddy stays their default edge with automatic Let's Encrypt certs.
• Phase 2 of the 161 rebuild needs no change here — when Coolify is evicted, auto-update stops layering the override and caddy takes the ports back.
• The toleration itself stays (under set -e a non-zero up would abort before the ingress reattach and the health gate that actually decides), but it no longer names a cause it cannot inspect.

How it surfaced

CI had been OOM-killed on every branch by the 2g container ceiling merged in #5562 — bunx tsc --noEmit, exit 137, no test output. Raising it, I reached for the bare compose up that this file's own header warns is unsafe on this box: it recreated gluecron detached from the coolify network and 502'd the site until the ingress guard from 39b591f reattached it ~60s later. That guard works exactly as designed. This removes the other half of the same trap.

Tests

• The toleration assertion now checks intent rather than the old wording, and forbids the pre-excused message.
• Two new guards pin the dedicated-edge profile and re-assert the create-time coolify attachment the override exists for — so a future edit can't quietly drop the ingress declaration while editing the profile.
• 29 pass across the auto-update + timer suites; tsc --noEmit clean.