Fix container updates: rebuild on new image, consolidate update scripts

Weekly sync window was pulling images but using docker start after rsync,
which ignores the new digest. Containers in the emby/critical-data profiles
(Emby, Mariadb, Redis) never actually landed on updated images.

docker_update_remaining.sh merged into docker_update.sh --remainder, which
already had better exclusion logic. Added WEEKLY_REMAINING_UPDATES toggle
and WEEKLY_RESTART_CONTAINERS exclusion to remainder mode.

Onboard now runs docker_network_connect.sh on mirror before deploying stacks.

Plugin/unraid/user_script_plug-in.sh

@@ -71,7 +71,7 @@
 #           Correct schedules verified against script headers. sunday_morning_coffee_report
 #           and rsync_emby_fallback added as separate scheduled entries.
 #   v2.3 — intermediate_sync_maintenance.sh new 4-hour orchestrator (arr_sync + artwork).
-#           docker_update.sh + docker_update_remaining.sh: daily/weekly image pulls.
+#           docker_update.sh (normal + --remainder): daily/weekly image pulls.
 #           downloaders_reset.sh: slskd + SABnzbd + qBittorrent maintenance.
 #           arr_sync.sh: bidirectional Lidarr/Sonarr/Radarr library mesh.
 #           lidarr_missing_art.sh: fetch missing album/artist artwork.
@@ -330,7 +330,7 @@
 #   7. Start remote containers  dependency order, new image, verify each container up
 #   8. Start local containers   dependency order, new image, verify each container up
 #   9. docker_weekly_restart.sh restart less-critical services: NextCloud, AdGuard, Immich
-#  10. docker_update_remaining.sh pull latest images for all containers not in daily/weekly lists
+# 10. docker_update.sh --remainder  pull latest images for all containers not in daily/weekly lists
 #  11. WEEKLY_MAINTENANCE_SCRIPTS — clear_logs.sh + playback_aware_*.sh discovery scripts.
 #                                playback_aware_lidarr_discovery.sh: 0–5 music adds/week
 #                                  based on your Emby play history + Last.fm similar artists.
@@ -653,28 +653,23 @@
 # bash /boot/config/plugins/varaverk/Docker_Essentials/docker_network_connect.sh --dry-run
 # bash /boot/config/plugins/varaverk/Docker_Essentials/docker_network_connect.sh
 
-# docker_update.sh — pull latest images for daily restart containers, no downtime
-# Called by daily_sync_maintenance.sh BEFORE docker_daily_restart.sh.
-# Targets HOST*_DAILY_RESTART_CONTAINERS — same list as daily restart, no separate config.
-# Containers stay running during the pull. docker_daily_restart.sh picks up the new image.
-# Reports "updated" vs "already current" per container — useful to see what actually changed.
-# Toggle: DAILY_CONTAINER_UPDATES=false in master.conf skips all pulls, restart still runs.
+# docker_update.sh — pull latest images for managed containers, rebuild those that got a new digest
+# Two modes, one script:
+#
+#   Normal (daily) — targets HOST*_DAILY_RESTART_CONTAINERS.
+#     Containers stay running during the pull. Rebuilds containers that received a new image.
+#     docker_daily_restart.sh restarts the rest. Toggle: DAILY_CONTAINER_UPDATES in master.conf.
+#
+#   Remainder (weekly) — targets all running containers not in managed lists.
+#     Excludes daily list, weekly restart list, emby+critical-data sync-window containers,
+#     and fallback containers owned by the remote server's update cycle.
+#     Rebuilds containers that received a new image. Toggle: WEEKLY_REMAINING_UPDATES in master.conf.
 #
 # bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update.sh --dry-run
 # bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update.sh --status
 # bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update.sh
-
-# docker_update_remaining.sh — pull latest images for all containers not in daily/weekly lists
-# Called by weekly_sync_maintenance.sh at the end of the Sunday window.
-# Derives target set from `docker ps` minus DAILY_RESTART_CONTAINERS + WEEKLY_RESTART_CONTAINERS.
-# Only running containers — stopped containers are excluded (likely paused intentionally).
-# Together with docker_update.sh and the weekly image pull: every deployed container gets
-# at least one image pull per week with no second list to maintain.
-# Toggle: WEEKLY_REMAINING_UPDATES=false in master.conf skips all pulls.
-#
-# bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update_remaining.sh --dry-run
-# bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update_remaining.sh --status
-# bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update_remaining.sh
+# bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update.sh --remainder
+# bash /boot/config/plugins/varaverk/Docker_Essentials/docker_update.sh --remainder --dry-run
 
 # downloaders_reset.sh — maintenance reset for all download clients on this server
 # Called every 30 minutes by critical_sync_maintenance.sh via CRITICAL_MAINTENANCE_SCRIPTS.