ops(systemd): follow the anchor container's netns across recreation

Recreating the Docker anchor left the supervised Core and host stranded in
the dead namespace while systemd still reported them active — serving
nobody, invisible to any monitoring that trusts unit state. Reproduced on
staging: netns 4026539938 -> 4026540033, both pids unchanged in the old
one, both units "active", traffic ConnectionResetError.

There is no systemd-native edge signal to bind to. Containers do appear as
units, but the scope name embeds the container ID (docker-<id>.scope), which
changes on every recreate, so BindsTo= has no stable target;
NetworkNamespacePath= resolves once at start; a .path unit on /run/netns
would watch the file this tooling maintains. So: a level-triggered reconcile
on a 10s timer, comparing the namespace the services are ACTUALLY in against
the anchor's CURRENT one, acting only on a real difference. That cannot miss
an event while the watcher restarts or dockerd is down, and needs no
debounce — a burst of three recreations produced exactly one rebind. The
trigger stays separable: a docker-events unit could invoke the same script.

Anchor absent stops the dependants rather than falling back to host
networking; docker unavailable logs once and retries on the next tick.

Two defects found while testing and fixed here:
- mount --bind STACKS when the old mount is busy, silently leaking nsfs
  entries; the bind helper now drains stale mounts in a loop.
- reconcile must stop -> rebind -> start, not rebind -> restart: a running
  service holds the old namespace open and makes the umount fail busy.

Staging also gained a faithful anchor container so the reproduction is
structural rather than mocked. Economy state was byte-identical across every
lifecycle test. Production units are templates only and remain uninstalled.

scripts/systemd/openfut-staging-host.service

@@ -8,6 +8,10 @@ Documentation=file:///home/alex/OpenFUT/scripts/systemd/README.md
 # traffic: the host cannot reach "active" while Core is not listening.
 Wants=openfut-staging-core.service
 After=openfut-staging-core.service
+# Requires on the NAMESPACE (hard) but only Wants on Core (soft) — the host
+# must never bind the host network, yet must survive a Core blip.
+Requires=openfut-staging-netns.service
+After=openfut-staging-netns.service
 
 # `Wants`, deliberately NOT `Requires`/`BindsTo`/`PartOf`. Those propagate a
 # Core stop into a host stop, and — measured, not assumed — a later Core start
@@ -32,6 +36,8 @@ User=alex
 Group=alex
 WorkingDirectory=/home/alex/openfut-sold-staging
 
+NetworkNamespacePath=/run/netns/openfut-staging
+
 EnvironmentFile=/home/alex/openfut-sold-staging/systemd/host.env
 
 # Readiness gate. Bounded, and FAILS rather than blocking forever: a host that