feat: podman-compose stack units and root/user execution scopes

- syncup: podman first, docker only as fallback (podman wins on name clash;
  existing docker units found in podman switch to podman)
- syncup: group podman-compose containers into one `kind: stack` unit per
  project (project, working_dir, compose_files, compose_bin from labels);
  disable existing member units ("part of stack <project>")
- generator: compose mode (podman-compose up/stop, WorkingDirectory) with
  pod start/stop fallback when compose binary/dir/files are missing
- reconcile: stacks disabled with "stack not found" when neither compose
  files nor pod exist
- root: scan root + rootless users listed in `users:` (podman only)
- non-root: config ~/.config/unitdore/units.yaml, own user units only
- sysuser package: runuser with XDG_RUNTIME_DIR/DBUS env, home/linger lookup
- install: warn when linger is not enabled for user units
- testdata/stack: podman-compose test stack and captured podman ps fixture
- docs: README, generated-units, man page, AGENTS, PLAN

README.md

@@ -2,7 +2,7 @@
 
 > *A door you open and close for container units.*
 
-Unitdore bridges your container runtime (Podman, Docker) and systemd. It discovers running containers, stores them in a config file, and generates + manages systemd `.service` units for each one.
+Unitdore bridges your container runtime (Podman, Docker) and systemd. It discovers running containers and podman-compose stacks, stores them in a config file, and generates + manages systemd `.service` units for each one.
 
 ## Install
 
@@ -54,6 +54,11 @@ sudo unitdore syncup
 
 Queries Podman and Docker for running containers, adds new ones to the config, and reconciles any that have disappeared (marking them disabled).
 
+- Podman first; Docker only for names Podman doesn't have
+- podman-compose containers → one `kind: stack` unit per project; existing member units disabled (`part of stack <project>`)
+- Root: root's containers + rootless Podman containers of each user in `users:`
+- Normal user: own Podman containers, config `~/.config/unitdore/units.yaml`, user units only
+
 ### Edit the config
 
 ```bash
@@ -104,6 +109,7 @@ oldthing   podman    hein    no        no          —                 container
 ```yaml
 prefix: ""                   # optional: prepended to all service names, e.g. "prod-"
 suffix: ""                   # optional: appended to all service names, e.g. "-svc"
+users: [hein]                # root only: rootless users scanned by syncup
 
 units:
   - name: nginx
@@ -121,8 +127,36 @@ units:
     order: 2
     delay: 5s
     enabled: true
+
+  - name: shop               # = compose project name
+    kind: stack              # container (default) | stack
+    runtime: podman
+    user: hein
+    project: shop
+    working_dir: /srv/shop   # from compose labels (refreshed by syncup)
+    compose_files: [compose.yaml]
+    compose_bin: /usr/bin/podman-compose
+    order: 3
+    enabled: true
 ```
 
+### Stacks (podman-compose)
+
+| Condition | Unit |
+|---|---|
+| `compose_bin`, `working_dir`, `compose_files` exist | `podman-compose -p <proj> -f <files> up` / `stop`, `Type=simple` |
+| any missing | `podman pod start/stop pod_<proj>`, `Type=oneshot` |
+| compose missing and no pod | `syncup` disables: `stack not found` |
+
+### Users
+
+| Run as | Config | Discovers | Units |
+|---|---|---|---|
+| root | `/etc/unitdore/units.yaml` | root + `users:` (Podman only for users) | system + user units |
+| user | `~/.config/unitdore/units.yaml` | own Podman | own user units |
+
+User units need linger to start at boot: `sudo loginctl enable-linger <user>` (`install` warns).
+
 ### Prefix and suffix
 
 Set `prefix` and/or `suffix` to namespace your service files:
@@ -147,6 +181,7 @@ See **[docs/generated-units.md](docs/generated-units.md)** for full examples cov
 - User units (rootless)
 - Docker vs Podman
 - Custom commands
+- Compose stacks (compose + pod fallback)
 - Prefix/suffix naming
 - Startup ordering
 - Unnamed containers (short ID fallback)
@@ -175,7 +210,7 @@ WantedBy=multi-user.target
 ## Flags
 
 ```
---config string   path to units config file (default "/etc/unitdore/units.yaml")
+--config string   path to units config file (default "/etc/unitdore/units.yaml"; non-root: ~/.config/unitdore/units.yaml)
 ```
 
 ## Requirements
@@ -183,4 +218,5 @@ WantedBy=multi-user.target
 - Go 1.21+
 - systemd
 - Podman and/or Docker (only what you have installed is used)
+- podman-compose for compose-mode stacks (pod fallback without it)
 - Root for system units; the relevant user for rootless units