[grade=B urn:ump:szxhoevzog44pvl3sz6n6qp2edv6wj6dcs3ajpi3kxbpbz7kikqa] DC-137: shipdeck engine branch for App Selector catalog installs

Opt-in (config.engine='shipdeck' + SHIPDECK_BRIDGE_URL configured + template
compatible): catalog installs go through the bridge's validated image-install
pipeline (digest-pinned OCI image, systemd release, Caddy gate, DNS, verify)
instead of Docker. Port semantics: engine is host-networked, so the app LISTEN
port (container side of the mapping, protocol suffix stripped) is gated —
never the Docker host port; no mapping falls back to defaultPort. Volumes:
absolute binds only, :ro preserved, named volumes and placeholders skipped.
Engine installs skip panel DNS + Caddy (pipeline did them), record an
engine=shipdeck manifest with the Shipdeckfile path, and removal runs
shipdeck rm via the registry. Failures return 502 with stage detail and
never fall back to Docker. Bridge unset = Docker path unchanged.

10 new tests (gating, payload mapping, route integration); full suite
138/138 suites 2933/2933 green. Judge: C -> C -> B zero-blockers.

status/js/app-selector.js

@@ -762,7 +762,8 @@
           tailscaleOnly: deployConfig.tailscaleOnly || false,  // Tailscale-only access restriction
           mediaPath: deployConfig.mediaPath || null,  // Media folder path for media apps
           plexClaimToken: deployConfig.plexClaimToken || null,  // Plex claim token for auto-claim
-          customVolumes: deployConfig.customVolumes || null  // Custom volume mount overrides
+          customVolumes: deployConfig.customVolumes || null,  // Custom volume mount overrides
+          engine: deployConfig.engine || null  // DC-137: 'shipdeck' opts this install into the shipdeck engine
         }
       };