fix: validate deployment rollback and server topology

deploy/compose.server.yaml

@@ -5,13 +5,30 @@ services:
       THOTH_PUBLIC_EXPOSURE: "true"
       THT_DATA_ROOT: /data
       THT_WORKSPACE_INSTALLATION_ID: server
+    # prepare-server-pi-state.sh creates the regular child targets before this parent bind is used.
+    # The real configuration sources still remain separate read-only mounts.
     volumes: !override
-      - ${THT_DATA_ROOT:?set THT_DATA_ROOT}:/data
-      - ${THT_PI_STATE_ROOT:?set THT_PI_STATE_ROOT}:/home/thoth/.pi
-      - ${PI_AUTH_FILE:?set PI_AUTH_FILE}:/home/thoth/.pi/agent/auth.json:ro
-      - ./deploy/pi/models.json:/home/thoth/.pi/agent/models.json:ro
-      - ./deploy/pi/settings.json:/home/thoth/.pi/agent/settings.json:ro
-      - ${THT_WORKSPACE_REGISTRY_ROOT:?set THT_WORKSPACE_REGISTRY_ROOT}:/data/workspace-registry
+      - type: bind
+        source: ${THT_DATA_ROOT:?set THT_DATA_ROOT}
+        target: /data
+      - type: bind
+        source: ${THT_PI_STATE_ROOT:?set THT_PI_STATE_ROOT}
+        target: /home/thoth/.pi
+      - type: bind
+        source: ${PI_AUTH_FILE:?set PI_AUTH_FILE}
+        target: /home/thoth/.pi/agent/auth.json
+        read_only: true
+      - type: bind
+        source: ./deploy/pi/models.json
+        target: /home/thoth/.pi/agent/models.json
+        read_only: true
+      - type: bind
+        source: ./deploy/pi/settings.json
+        target: /home/thoth/.pi/agent/settings.json
+        read_only: true
+      - type: bind
+        source: ${THT_WORKSPACE_REGISTRY_ROOT:?set THT_WORKSPACE_REGISTRY_ROOT}
+        target: /data/workspace-registry
     restart: unless-stopped
 
   frontend: