fix: make goosed remount health ignore canary

Stable remount checks required exactly 9 compose containers, but the
shared goosed-prod project also runs canary. Count only goosed-1..9 and
verify the /opt/portal bind plus a root marker under the live runtime.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/release-portal-runtime-prod.sh

@@ -432,7 +432,7 @@ remount_goosed_after_live_swap() {
   local docker_bin="/opt/homebrew/bin/docker"
   local compose_dir="/Users/john/Project/goosed-prod"
   local compose_file="${compose_dir}/docker-compose.prod.yml"
-  local marker_rel="MindSpace/.goosed-remount-${RELEASE_ID}"
+  local marker_rel=".goosed-remount-${RELEASE_ID}"
   local marker_host="${APP_DIR}/${marker_rel}"
   local marker_value="${RELEASE_ID}-$(date +%s)"
   local ready=0
@@ -442,7 +442,7 @@ remount_goosed_after_live_swap() {
     return 1
   fi
 
-  mkdir -p "${APP_DIR}/MindSpace"
+  mkdir -p "${APP_DIR}"
   printf '%s\n' "${marker_value}" > "${marker_host}"
 
   say "重建 goosed 容器以刷新 Portal/MindSpace bind mount"
@@ -458,7 +458,9 @@ remount_goosed_after_live_swap() {
     local healthy=1
     local containers=()
     while IFS= read -r container; do
-      [[ -n "${container}" ]] && containers+=("${container}")
+      # Exclude canary/other services that share the compose project label.
+      [[ "${container}" =~ ^goosed-prod-[1-9]$ ]] || continue
+      containers+=("${container}")
     done < <("${docker_bin}" ps \
       --filter 'label=com.docker.compose.project=goosed-prod' \
       --format '{{.Names}}')
@@ -475,8 +477,15 @@ remount_goosed_after_live_swap() {
         healthy=0
         continue
       fi
+      local portal_source
+      portal_source="$("${docker_bin}" inspect "${container}" --format '{{range .Mounts}}{{if eq .Destination "/opt/portal"}}{{.Source}}{{end}}{{end}}' 2>/dev/null || true)"
+      if [[ "${portal_source}" != "${APP_DIR}" ]]; then
+        healthy=0
+        continue
+      fi
       local observed
-      observed="$("${docker_bin}" exec "${container}" sh -lc "cat '${APP_DIR}/${marker_rel}'" 2>/dev/null || true)"
+      # Prefer /opt/portal marker (same bind as PORTAL_RUNTIME_DIR) over nested MindSpace.
+      observed="$("${docker_bin}" exec "${container}" sh -lc "cat '/opt/portal/${marker_rel}'" 2>/dev/null || true)"
       if [[ "${observed}" != "${marker_value}" ]]; then
         healthy=0
       fi