fix: discover orphan compose networks so wt prune can reclaim subnet slots

[pkudinov]

Summary

• Label the compose default network with the same dev.tokenbooks.wt.* labels we already put on containers, so Docker carries the wt project identity on the network itself.
• Extend listManagedDockerProjectsForRepo to scan docker network ls --filter label=…repo-root=… in addition to containers, so projects whose containers were reaped but whose network survives are still discoverable. wt prune already iterates this list, so the recovery path lights up automatically — no command-surface changes.

Why

wt new started failing with:

Error response from daemon: all predefined address pools have been fully subnetted
failed to create network wt-4-tokenbooks-<hash>_default

On the affected machine, docker network ls showed 24 wt-*-…_default networks but only one had any containers — the other 23 were holding subnet slots from Docker's default address pool with no way for wt prune to find them (its discovery starts from container labels, and Compose-applied labels don't carry the wt repo identity).

After this fix, wt prune finds and removes the orphans. The leak window remains — Ctrl+C during docker compose up, Docker Desktop reset, etc. can still strand a network — but recovery becomes a wt prune away instead of a manual docker network prune.

Test plan

• Unit tests for the new behaviour (TDD-style, RED-then-GREEN):
  • buildDockerComposeConfig renders the labeled default network
  • listManagedDockerProjectsForRepo reports network-only orphans
  • It does not double-count projects that have both containers and a network
  • The network discovery uses the repo-root + managed label filters
• Integration test (WT_RUN_DOCKER_TESTS=1) that exercises real Docker:
  1. ensureDockerServices starts redis
  2. docker rm -f the container to simulate a reap that leaves the network behind
  3. listManagedDockerProjectsForRepo reports the orphan with services: [], containerNames: []
  4. removeDockerServices cleans the network up
• Full pre-existing suite still green (pnpm test, pnpm lint, pnpm build).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR improves wt prune’s ability to reclaim Docker subnet slots by ensuring Compose networks carry the same dev.tokenbooks.wt.* identity labels as containers, and by extending project discovery to include labeled networks (so projects remain discoverable even if their containers were removed).

Changes:

• Add dev.tokenbooks.wt.* labels to the Compose default network generated by buildDockerComposeConfig.
• Extend listManagedDockerProjectsForRepo to discover “network-only” orphan projects via docker network ls + docker network inspect.
• Add unit + Docker integration tests covering network orphan discovery and non-duplication behavior; update README documentation for the new recovery path.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/core/docker-services.ts	Labels the default Compose network and adds network-based discovery for managed Docker projects.
README.md	Documents that wt prune now also recovers orphaned Docker networks that consume subnet slots.
__tests__/docker-services.spec.ts	Adds unit tests for network labeling and network-only orphan discovery (including dedupe + filter assertions).
__tests__/docker-services.docker.spec.ts	Adds an integration test that removes a container while leaving its network, verifying discovery + cleanup.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.