Two stacks on one host are not isolated -- make post writes to the wrong one

[catinspace-au]

Two dfe-docker stacks cannot safely coexist on one host, and the failure mode is that one silently operates on the other.

A compose project name is supposed to isolate a second stack. Here it does not, in three separate places. Found while standing up a second stack for the Playwright acceptance suite, alongside a running rc14 stack.

1. make post injects into the wrong stack. scripts/post.py sets API_EXEC_SERVICE = "dfe-engine" and runs docker exec dfe-engine. That is a daemon-wide container NAME, not a compose service, so it resolves to whichever stack owns the name -- the other one. make post, make dev and make ci all auto-run it, so any of those from a second checkout pushes test data into the running stack you were not touching. This is the worst of the three because it writes data and looks like it worked.

2. Container logs go to the other stack's collector. docker-compose.container-logs.yml uses DFE_CONTAINER_LOG_ADDRESS:-tcp://127.0.0.1:24224, a hardcoded literal that ignores DFE_OTEL_FLUENT_PORT. Shift the OTel port for a second stack and the logging address does not follow.

3. container_name: is hardcoded on all 35 services. So -p <project> alone cannot isolate anything -- the second stack either collides on the name or quietly attaches to the first. Working around it needs an overlay that re-prefixes all 35.

Two smaller ones from the same exercise:

• .profile.mk is consumed through make's export. Drive docker compose directly and you get none of it, so compose falls back to its :-kafka.yaml defaults and a slim stack crash-loops on a broker it does not have. The values should be generated into .env rather than living only in make's environment.
• ClickHouse host ports cannot be shifted from .env at all: CLICKHOUSE_HTTP_PORT and CLICKHOUSE_NATIVE_PORT (docker-compose.yml:1060-1061) are ALSO the in-network ports dfe-engine dials, so changing them to free a host port breaks the stack internally. Already known as issue Moving the published ClickHouse port breaks the engine, because the same variable is the in-network port #75.

Concurrent stacks are worth supporting rather than warning about -- this host has the resources, and a second stack is the only way to run the destructive e2e suite without wiping the one you want to inspect.

Done when docker compose -p other-name up gives you a stack that cannot touch the first one.

[catinspace-au]

Mostly done. make post finds the engine through docker compose ps in its own project now (scripts/post.py:409-417). #128 put DFE_CONTAINER_PREFIX on all 35 container names. The log driver address follows DFE_OTEL_FLUENT_PORT (docker-compose.container-logs.yml:45). #161 split the ClickHouse publish from the in-network dial, which closed #75. What is left is the smaller one: the profile values still live only in .profile.mk through make's include (Makefile:59), so a bare docker compose run gets none of them. Leaving open for that.