P2.2-P2.9, P3.2-P3.10, P4.1-P4.3: Complete Phases 2, 3, and 4

11 work units built in parallel and merged:

Agent handlers (Phase 2):
- P2.2 Deploy: pull images, stop/remove/run containers, update registry
- P2.3 Lifecycle: stop/start/restart with desired_state tracking
- P2.4 Status: list (registry), live check (runtime), get status (drift+events)
- P2.5 Sync: receive desired state, reconcile unmanaged containers
- P2.6 File transfer: push/pull scoped to /srv/<service>/, path validation
- P2.7 Adopt: match <service>-* containers, derive component names
- P2.8 Monitor: continuous watch loop, drift/flap alerting, event pruning
- P2.9 Snapshot: VACUUM INTO database backup command

CLI commands (Phase 3):
- P3.2 Login, P3.3 Deploy, P3.4 Stop/Start/Restart
- P3.5 List/Ps/Status, P3.6 Sync, P3.7 Adopt
- P3.8 Service show/edit/export, P3.9 Push/Pull, P3.10 Node list/add/remove

Deployment artifacts (Phase 4):
- Systemd units (agent service + backup timer)
- Example configs (CLI + agent)
- Install script (idempotent)

All packages: build, vet, lint (0 issues), test (all pass).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/agent/adopt.go

@@ -0,0 +1,114 @@
+package agent
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	mcpv1 "git.wntrmute.dev/kyle/mcp/gen/mcp/v1"
+	"git.wntrmute.dev/kyle/mcp/internal/registry"
+	"git.wntrmute.dev/kyle/mcp/internal/runtime"
+)
+
+// AdoptContainers discovers running containers that match the given service
+// name and registers them in the component registry. Containers named
+// "<service>-*" or exactly "<service>" are matched.
+func (a *Agent) AdoptContainers(ctx context.Context, req *mcpv1.AdoptContainersRequest) (*mcpv1.AdoptContainersResponse, error) {
+	service := req.GetService()
+	if service == "" {
+		return nil, fmt.Errorf("service name is required")
+	}
+
+	containers, err := a.Runtime.List(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("list containers: %w", err)
+	}
+
+	prefix := service + "-"
+
+	// Filter matching containers before modifying any state.
+	type match struct {
+		container runtime.ContainerInfo
+		component string
+	}
+	var matches []match
+	for _, c := range containers {
+		switch {
+		case c.Name == service:
+			matches = append(matches, match{c, service})
+		case strings.HasPrefix(c.Name, prefix):
+			matches = append(matches, match{c, strings.TrimPrefix(c.Name, prefix)})
+		}
+	}
+
+	if len(matches) == 0 {
+		return &mcpv1.AdoptContainersResponse{}, nil
+	}
+
+	// Ensure the service exists once, before adopting any containers.
+	if err := registry.CreateService(a.DB, service, true); err != nil {
+		if _, getErr := registry.GetService(a.DB, service); getErr != nil {
+			return nil, fmt.Errorf("create service %q: %w", service, err)
+		}
+	}
+
+	var results []*mcpv1.AdoptResult
+	for _, m := range matches {
+		a.Logger.Info("adopting", "service", service, "container", m.container.Name, "component", m.component)
+
+		// Inspect the container to get full details (List only returns
+		// name, image, state, and version).
+		info, err := a.Runtime.Inspect(ctx, m.container.Name)
+		if err != nil {
+			results = append(results, &mcpv1.AdoptResult{
+				Container: m.container.Name,
+				Component: m.component,
+				Success:   false,
+				Error:     fmt.Sprintf("inspect container: %v", err),
+			})
+			continue
+		}
+
+		comp := &registry.Component{
+			Name:          m.component,
+			Service:       service,
+			Image:         info.Image,
+			Network:       info.Network,
+			UserSpec:      info.User,
+			Restart:       info.Restart,
+			DesiredState:  desiredFromObserved(info.State),
+			ObservedState: info.State,
+			Version:       info.Version,
+			Ports:         info.Ports,
+			Volumes:       info.Volumes,
+			Cmd:           info.Cmd,
+		}
+
+		if createErr := registry.CreateComponent(a.DB, comp); createErr != nil {
+			results = append(results, &mcpv1.AdoptResult{
+				Container: m.container.Name,
+				Component: m.component,
+				Success:   false,
+				Error:     "already managed",
+			})
+			continue
+		}
+
+		results = append(results, &mcpv1.AdoptResult{
+			Container: m.container.Name,
+			Component: m.component,
+			Success:   true,
+		})
+	}
+
+	return &mcpv1.AdoptContainersResponse{Results: results}, nil
+}
+
+// desiredFromObserved maps an observed container state to the desired state.
+// Running containers should stay running; everything else is treated as stopped.
+func desiredFromObserved(observed string) string {
+	if observed == "running" {
+		return "running"
+	}
+	return "stopped"
+}