Fix L4 port manager failing to recreate caddy after Docker restart

The sidecar's `docker compose up` command lacked `--pull never`, so
Docker Compose would attempt to pull the caddy image from ghcr.io when
the local image was missing or stale. Since the sidecar has no registry
credentials this failed with 403 Forbidden.

Closes #117

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/unit/l4-port-manager-entrypoint.test.ts

@@ -89,12 +89,12 @@ describe('L4 port manager entrypoint.sh', () => {
     expect(script).toContain('"$CURRENT_TRIGGER" = "$LAST_TRIGGER"');
   });
 
-  it('does not pull images (only recreates)', () => {
+  it('uses --pull never to avoid registry pulls (only recreates)', () => {
     const composeUpLines = lines.filter(line =>
       line.includes('docker compose') && line.includes('up')
     );
     for (const line of composeUpLines) {
-      expect(line).not.toContain('--pull');
+      expect(line).toContain('--pull never');
       expect(line).not.toContain('--build');
     }
   });