fix: remove container check from stability_watchdog, add USB boot warning

stability_watchdog: container health is owned by docker_watchdog — rebooting
when docker_watchdog skip-lists a container creates a reboot loop. Removed
SYS_WATCHDOG_CHECK_CONTAINERS check entirely. docker_watchdog handles
strikes, restart attempts, skip-listing, and notifications.

varaverk.plg: warn on USB/removable boot device at install time. Plugin is
designed for internal NVMe/SSD boot. Warning is non-blocking but clear.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Watchdogs/stability_watchdog.sh

@@ -50,7 +50,8 @@
 # Checks Run Every Cycle
 #   rootfs usage, /var/log, /tmp, free RAM, ZFS ARC, CPU temp, load avg,
 #   zombie processes, Docker daemon, OOM rate, /boot read-only, kernel oops,
-#   file descriptor exhaustion, array disk errors, NIC state, required containers.
+#   file descriptor exhaustion, array disk errors, NIC state.
+#   (Container health is owned by docker_watchdog — not checked here.)
 #
 # ==============================================================================================
 # OPERATIONAL SAFEGUARDS
@@ -84,7 +85,6 @@
 #
 #   SYS_WATCHDOG_STATE_FILE  — strike counters and cycle state
 #   SYS_WATCHDOG_REBOOT_LOG  — reboot history for rate limiting
-#   SYS_WATCHDOG_FAILED_FILE — containers confirmed down for skip list integration
 #   SYS_WATCHDOG_OOM_FILE    — OOM kill counter from previous cycle
 #
 # ==============================================================================================
@@ -766,22 +766,10 @@ echo "━━━ $ICON_REBOOT Stability Watchdog — $(date '+%Y-%m-%d %H:%M:%S')
         fi
     fi
 
-    # ── Required containers from docker_watchdog skip list ────────────────────────────────────
-    if [[ "$SYS_WATCHDOG_CHECK_CONTAINERS" == true ]] && [[ -s "$SYS_WATCHDOG_FAILED_FILE" ]]; then
-        FAILED_CONTAINERS=()
-        while IFS= read -r container; do
-            [[ -z "$container" ]] && continue
-            STATUS=$(timeout "$DOCKER_TIMEOUT" docker inspect -f \
-                '{{.State.Running}}' "$container" 2>/dev/null || echo "unknown")
-            [[ "$STATUS" != "true" ]] && FAILED_CONTAINERS+=("$container")
-        done < "$SYS_WATCHDOG_FAILED_FILE"
-
-        TRIGGERED=false
-        [[ ${#FAILED_CONTAINERS[@]} -gt 0 ]] && TRIGGERED=true
-        run_strike_check "failed_containers" "$TRIGGERED" \
-            "required containers stopped: ${FAILED_CONTAINERS[*]:-}" && \
-            TRIGGERS+=("containers=${FAILED_CONTAINERS[*]:-}")
-    fi
+    # ── Required containers — removed from stability_watchdog ────────────────────────────────
+    # Container health is owned entirely by docker_watchdog: strike system, restart attempts,
+    # skip-listing, and critical notifications. Rebooting here when docker_watchdog already
+    # gave up creates a reboot loop — the container is still broken after reboot.
 
     # ==========================================================================================
     # ━━━ Evaluate Standard Triggers ━━━