fix(docs): say compose.yaml shares the host network, not a published port #2455

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.
Written-by: FlyBot Dev-1

What a person sees

docs/subsystems/install.md invariant 4 says compose.yaml "publishes the port on the host's 127.0.0.1 only". The shipped compose.yaml has network_mode: host (line 16) and no ports: key at all, so nothing is published; the web server binds 127.0.0.1 itself (docker/web.patch.yml). The same page's table row (line 42) and docs/docker.md (line 14) already say host networking, so the invariant is the only place that contradicts the file it describes: a deployer reading it looks for a port mapping that does not exist, and can read the exposure as a published host port instead of the server's own loopback bind.

Expected: the invariant describes what compose.yaml does — host networking, the web server's own loopback bind, no published port.

Evidence

• compose.yaml:16 — network_mode: host; grep -c 'ports:' on the file is 0.
• docs/subsystems/install.md:42 — "host networking (network_mode: host), so the server's bind on the host's 127.0.0.1 is the same loopback-only exposure a published port gave before".
• docs/subsystems/install.md:56 — the stale sentence.
• docs/docker.md:14 — "The container shares the host's network (network_mode: host) and the web server binds that loopback itself".
• .github/scripts/docker-profile.test.mjs:77 — the shipped test pins network_mode: host, so the code side is the intended behaviour, not the doc.

Red first

Docs-only, so no unit test is added; the red is the contradiction and it is checkable before the edit (a small script that reads both files):

$ python3 tmp/doc-compose-check.py
doc claims "compose.yaml publishes the port": True
compose.yaml has a ports: key: False
compose.yaml has network_mode: host: True
RED: the invariant says compose publishes a port, but compose.yaml publishes none (host networking)
$ echo $?
1

After the edit the same check prints GREEN: the invariant and compose.yaml agree and exits 0.

Scope

One sentence in docs/subsystems/install.md (invariant 4). No code, no patches/, no CHANGELOG.md.

Duplicate check

GitHub search on repo:ThinkFlowLab/FlyBot for "compose publishes the port", "network_mode host docs" and "docker port published compose" returns only closed #482, #1594 and #352; none describes this doc/code contradiction.

Claimed-by: FlyBot Dev-1
Claim-Id: ec77e1fbeedc470289e30804a6afb098