[jonbaldie]

Summary

backend overrides
  render candidate on destination filesystem
  compile selected VCL with isolated include/work paths
    --check → discard candidate
    startup → atomic rename → exec varnishd

Keep existing backends when no overrides are supplied. The renderer alone owns backend defaults. Replace check-time file-write assertions with active VCL evidence and real-container isolation/restart coverage.

Fixes #158.

Evidence

• Before: Real nohost.invalid checks exited 2 and changed the live backend on two consecutive runs. The new regression failed with FAIL: check/start overwrote live VCL.
  After: Successful/failed checks and failed startup preserve every live VCL hash; concurrent checks clean candidates; HTTP remains available after failed check and restart. An unresolvable candidate produces VCC diagnostics, proving compilation uses the candidate rather than the live backend.
• Passed make test-vcl-compile and make test-smoke-runtime-interface against the built image.
• Passed COMPOSE_PARALLEL_LIMIT=1 make -j1 test test-e2e-hard serially, including real HTTP backend-adapter scenarios.

Root cause: startup rendered directly into the live backend before reaching compilation or the check/start branch. Compilation failure therefore left an invalid persistent backend behind.

Merge Danger

Door: two-way

Blast Radius: startup

Embedded VCL now resolves its backend through the VCL include path. Mounted/custom VCL without backend overrides retains its current behavior. Listen binding during checks is unchanged. No cache-policy changes.