destroy --volumes misses legacy Compose interpolation env

[vishr]

Problem

ob destroy --volumes cannot tear down an app after migrating from a legacy release that embedded PostgreSQL/Redis workloads to Onebox supporting services.

With signed ob v2026.8.3, the active release Compose file contained:

POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}

The matching legacy runtime environment existed in the release, and the native service credential files existed under the app state directory. After typing the app name at the destructive confirmation, destroy stopped immediately with:

compose down: error while interpolating services.postgres.environment.POSTGRES_PASSWORD: required variable POSTGRES_PASSWORD is missing a value

No application container or volume was removed.

Expected

Destroy loads the environment needed to parse the recorded release Compose file, or tears down the recorded Compose project without requiring application interpolation values. It should then remove native service projects/volumes and app state as requested while preserving the host proxy unless --proxy is supplied.

Impact

The documented destructive lifecycle is blocked precisely during a clean migration to native Onebox services. Operators must manually reproduce project-scoped Compose teardown and remove Onebox state.

Workaround used

• run the recorded legacy Compose teardown with a non-secret placeholder sufficient for interpolation
• run each generated supporting-service Compose teardown with --volumes
• remove only the app state and legacy app bind mounts

This is separate from Redis health-check issue #76.