compose: restart policy for a container that exits after readiness

Split out of the review of #2034 (comment).

The problem

There is no restart policy. A container that exits after readiness takes its transitive dependents down and stays down: any crash is permanent until someone runs up again.

Shape

containers:
  api:
    worker: path://./workers/api
    restart: on-failure    # what the supervisor does when a ready container exits

No restart is the default and matches today's behaviour.

Why this is its own phase rather than part of #2051

required is a branch in lifecycle.rs. A restart policy is a supervisor, and needs decisions this issue exists to make:

• backoff between attempts, and a cap on them;
• what happens when the cap is reached — does the container become failed, and do its dependents come down then or at the first exit;
• what happens to dependents during the restart window, since they are talking to something that is briefly gone;
• how compose::status represents "restarting", which is a state that does not exist today;
• whether restart: always is distinct from on-failure, and what either means for a container that never became ready in the first place.

Shipping it without backoff and a cap turns a crash loop into a busy loop.

Documented as a v1 limitation in understanding-iii/compose.