Initial design spec for package-updater service: - Go HTTP service triggered by Gitea Actions webhook - Discovers Compose-managed containers via Docker labels - Two-gate security: bearer token + opt-in label - Stateless, single-worker, no rollback in v1 - Loki structured logs + Prometheus metrics - Reusable composite Gitea action Decisions reached via brainstorming session 2026-05-22.