feat!: remove checkpoint/restore and the Podman backend

.dap/review/engineering.md

@@ -46,11 +46,11 @@ Refines `D1`. This repository implements the same behaviour more than once by de
   (`docker compose`). A fix, guard, or flag added to one and not the other is a finding —
   name the sibling call site and say what it does instead. Both paths carried the same
   recreate bug (#71, #72) and the same entrypoint gap (#103).
-- **runtime** has `docker`, `podman`, and `applecontainer` backends behind one interface.
+- **runtime** has `docker` and `applecontainer` backends behind one interface.
   A change to shared orchestration must state what each backend does with it; a change
-  inside one backend must say whether the others need the same. Podman and Apple both
-  diverge from Docker in ways that have already broken workspaces (below).
-- A capability probe or opt-in flag (the health-probing opt-in, for instance) is the
+  inside one backend must say whether the other needs the same. Apple diverges from
+  Docker in ways that have already broken workspaces (below).
+- A capability flag on `Capabilities()` (`ServiceNameDNS`, for instance) is the
   legitimate way to encode divergence. A silent assumption that all backends behave like
   Docker is not.
 

CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Removed
+
+- **BREAKING — checkpoint/restore is gone.** The feature only ever
+  worked on Podman (docker's restore is broken upstream on
+  containerd-integrated engines), and the Podman backend existed to
+  carry it. Neither of the remaining backends can checkpoint — docker
+  for the reason above, applecontainer because it has no CRIU — so with
+  Podman gone the feature has no implementation and both go. Removed
+  from the public API: `runtime.CheckpointRuntime`,
+  `runtime.CheckpointSpec`, `runtime.RestoreSpec`,
+  `runtime.CheckpointRef`, `runtime.ErrCheckpointUnsupported`,
+  `runtime.CheckpointFailedError`, `runtime.RestoreFailedError`,
+  `runtime.Capabilities.Checkpoint`, `Engine.Checkpoint`,
+  `Engine.Restore`, `Engine.CheckpointProject`,
+  `Engine.RestoreProject`, and their option/result types
+  (`ProjectCheckpointOptions`, `ProjectRestoreOptions`,
+  `ProjectCheckpointRef`, `ServiceCheckpoint`).
+- **BREAKING — the `runtime/podman` backend is removed.** It reached
+  Podman through the docker-compatible socket purely so it could add
+  CRIU checkpoint/restore via libpod; nothing else depended on it.
+- **compose (native)** — the orchestrator-driven health-probing path is
+  removed with it. The `selfHealthProber` opt-in
+  (`PreferSelfProbedHealth()`) existed solely because Podman runs a
+  container's HEALTHCHECK eagerly as root, which races
+  privilege-dropping images; Docker and Apple never opted in, so the
+  path was unreachable. Health gating now always reads the backend's
+  native health status, which is what Docker and Apple already did.
+- The design records for the removed subsystems —
+  `design/checkpoint-restore.md`, `design/podman-backend.md` and
+  `design/compose-native-health.md` — are deleted with the code they
+  described. The 0.4.0 entry below names
+  `design/compose-native-health.md`; all three remain readable in git
+  history at tag `v0.4.3`.
+
 ## [0.4.2] - 2026-08-23
 
 ### Fixed

attach.go

@@ -67,10 +67,9 @@ func (e *Engine) AttachWith(ctx context.Context, id WorkspaceID, opts AttachOpti
 }
 
 // reattachWorkspace rebuilds a *Workspace from an already-inspected,
-// running container. It is shared by Attach (container found by label)
-// and Restore (container freshly imported from a checkpoint archive):
-// both have a live container and need the same MINIMAL config + bound
-// substituter + userEnv probe, without re-reading devcontainer.json.
+// running container found by label. It needs only the MINIMAL config +
+// bound substituter + userEnv probe, without re-reading
+// devcontainer.json.
 //
 // It reconstructs just enough config for the substituter (Attach can't
 // reproduce the full ResolvedConfig — the source devcontainer.json may