fix: unblock instanceable connectivity store-service install + clean up on delete

Live verification on pic1 of the connectivity v2 multi-instance feature
surfaced four integration bugs that prevented installing any published
connectivity store service (proxy/wireguard-ext/openvpn-client/sshuttle)
and left stale host routing state behind. All four are fixed here:

1. manifest_validator rejected the CI-published `name:tag@sha256:<digest>`
   image form (it required digest-only), while service_store_manager already
   accepted it — so every published store image failed validation. Allow an
   optional tag before the digest, matching service_store_manager.

2. The cell-api image shipped the docker CLI but not the Compose v2 plugin,
   so every `docker compose` ServiceComposer runs (pull/up/down for store
   services) failed with "'compose' is not a docker command". Copy the
   compose plugin binary from the docker-cli stage.

3. service_store_manager.install ran the base compose up for instanceable
   services, whose template still contains ${INSTANCE_ID}/${REDIRECT_PORT}
   (there is no base container — one runs per connection instance). It now
   verifies the image signature but defers the container to connection
   creation for instanceable manifests.

4. delete_connection freed the record/secrets/container but never removed the
   connection's individually-managed `ip rule fwmark->table` or its FORWARD
   kill-switch (apply_routes only flushes the PIC_CONNECTIVITY chains and
   re-adds rules for surviving connections), leaking stale host routing state.
   It now tears both down; added _remove_killswitch.

Verified end-to-end on pic1: two proxy instances allocate distinct
marks/tables/ports (skipping in-use resources), render distinct per-instance
containers, two peers route through distinct instances (per-peer MARK +
REDIRECT), delete is blocked while referenced (409) and cleans its ip rule.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

api/service_store_manager.py

@@ -333,16 +333,32 @@ class ServiceStoreManager(BaseServiceManager):
             except Exception as e:
                 return {'ok': False, 'error': f'Failed to fetch compose template: {e}'}
 
-            # Write compose file and start containers (validation inside write_compose)
+            # Write compose file and start containers (validation inside write_compose).
+            # Instanceable connectivity services back one container PER connection
+            # instance, rendered later by ConnectivityManager with a concrete
+            # ${INSTANCE_ID}/${REDIRECT_PORT}. Their base template still contains
+            # those placeholders, so there is no base container to bring up at
+            # install time — rendering/pulling/up-ing it here fails on the unset
+            # variables. Verify the image signature now (the enforce gate still
+            # applies), but defer the container to connection creation.
             if self.service_composer is not None:
-                try:
-                    result = self.service_composer.install(service_id, manifest, template_content)
-                except ValueError as e:
-                    return {'ok': False, 'error': str(e)}
-                except Exception as e:
-                    return {'ok': False, 'error': f'Failed to start service: {e}'}
-                if not result.get('ok'):
-                    return {'ok': False, 'error': result.get('error') or result.get('stderr', 'docker up failed')}
+                if manifest.get('instanceable'):
+                    try:
+                        verify = self.service_composer.verify_image(service_id, manifest)
+                    except Exception as e:
+                        return {'ok': False, 'error': f'image verification failed: {e}'}
+                    if not verify.get('ok'):
+                        return {'ok': False,
+                                'error': verify.get('error', 'image verification failed')}
+                else:
+                    try:
+                        result = self.service_composer.install(service_id, manifest, template_content)
+                    except ValueError as e:
+                        return {'ok': False, 'error': str(e)}
+                    except Exception as e:
+                        return {'ok': False, 'error': f'Failed to start service: {e}'}
+                    if not result.get('ok'):
+                        return {'ok': False, 'error': result.get('error') or result.get('stderr', 'docker up failed')}
 
             # Persist minimal install record. For instanceable connectivity
             # services the raw compose template is stored so ConnectivityManager