`local postgres` leaves anonymous volumes behind when removing PostgreSQL 18 containers

## Validated scope and current-PR plan — 2026-09-11

This section records the QA review and the current decision to finalize existing PRs without opening new PRs. It supersedes the proposed routing/fix suggestions in the original report below; the original observations are retained. Central plan: #757.

### Disposition

Deferred from this existing-PR finalization pass. Keep the issue open; no new PR is requested now. This is not a resolution, a severity downgrade, or a waiver of release acceptance.

### Validation and corrections

Source confirms binding the legacy PGDATA child and removing containers with force(true), without volume removal. Official Postgres 18 image declares the parent volume; the report should say per container creation, not necessarily every restart of an existing container. Fix cleanup centrally, including rollback/recreation paths, and verify data persistence across stop/start. A mount layout change must remain version-aware and handle existing data. Not part of #815 or #783.

---

## Original QA report

Found in the 2026-09-11 QA sweep of the combined PR stack at [`d2c37f81`](https://github.com/ClickHouse/clickhousectl/commit/d2c37f814fff53fe68d636e34103e2d0550bf84d), top PR #823, installed release build (package version still 0.4.2). Reproduced behaviour only; no implementation included.

Severity: medium; unbounded accumulation of unlabelled dangling volumes.

```sh
docker volume ls -q | wc -l # N
clickhousectl local postgres start --name v1
docker inspect clickhousectl-pg-v1-18 --format '{{json .Mounts}}'
# [{"Type":"bind","Source":".../v1-pg18/data","Destination":"/var/lib/postgresql/data"},
# {"Type":"volume","Name":"279d5507…","Destination":"/var/lib/postgresql"}]
clickhousectl local postgres stop v1 && clickhousectl local postgres remove v1
docker volume ls -q | wc -l # N+1, 279d5507… dangling forever
```

The official `postgres` image declares `VOLUME /var/lib/postgresql` (the parent of the bind-mounted `data` dir), so Docker creates one anonymous volume per container. `remove` does not pass the remove-volumes option. Two QA sessions leaked 10 volumes; nothing labels them as clickhousectl's.

Suggested: remove the container with anonymous-volume removal (`docker rm -v` equivalent) in the `remove` handler; consider mounting the parent path instead so no anonymous volume is created. Cover with a `local_postgres_*`/`local_docker_*` test asserting the volume count is unchanged after start+remove.

Start with the central plan in #757 and inspect the local postgres remove handler, including rollback and recreation paths. Use the mentioned local_postgres_* or local_docker_* tests to verify that start and remove leave the Docker volume count unchanged, while existing data persists across stop/start and version-aware mount handling remains intact.

Written by the indexing model from the issue text.