ops: add komodo stack hygiene posture-check

Catches the failure class that let immich_new slip through: stacks
without a configured repo, project_missing, hash drift, and repo
compose files without a matching Komodo stack. Dry-run on host found
6 honest warnings, 0 critical. Wrapper as Unraid User Script for
weekly cadence is tracked in MASTER_TODO.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/MASTER_TODO.md

@@ -25,6 +25,7 @@ Host-Reports (`/mnt/user/backups/restore-reports/`) und in der Git-Historie.
 | Restore-Test Tailscale | Operator | State-Validierung + Reconnect nur auf Wegwerf-Host/VM, danach Geraet in Tailscale-Admin entfernen | `ops/restore-tests/tailscale-runbook.md` |
 | Authelia OIDC fuer Apps | Operator/Claude | Live: Grafana + Mealie (verifiziert), Paperless deployed (Login-Test offen). Immich + Nextcloud bewusst geparkt bis Family-Onboarding (siehe `docs/DECISIONS.md` 2026-06-06) | `docs/AUTHELIA_OIDC_PLAN.md` |
 | Audit-PDF aus `docs/` entfernen | Operator | `docs/KalliLab_CORE_Audit_2026-06-06.pdf` (untracked) extern ablegen (H:/ oder Documents-Share) und lokal loeschen; Binaerdateien gehoeren nicht ins GitOps-Repo | Doku-Regeln `docs/REPO_MAP.md` |
+| Komodo-Stack-Hygiene-Check aktivieren | Operator | Skript `services/posture-check/komodo-stack-hygiene.sh` ist gemerged und auf dem Host getestet. Verbleibt: Unraid User Script `komodo-stack-hygiene-weekly` anlegen, der `bash /mnt/user/services/homelab-infra/services/posture-check/komodo-stack-hygiene.sh` ausfuehrt. Findet u.a. die `immich_new`-Klasse (Stack ohne Repo, `project_missing`, Compose-File ohne Stack). | `services/posture-check/komodo-stack-hygiene.sh` |
 
 ---