upgrading docker-ce while the service is stopped leads to delayed/surprise service restart

we just recently discovered that if you upgrade the docker-ce package (at least on oracle9 with the rhel9 packages) while the docker service is stopped, then the docker service will be still marked as needs-restart after the upgrade
that is not neccessary as when the service will be started after the package upgrade, it will be running the new version, so there is no need for another restart

but because of the lingering mark, the next (random) execution of systemctl reload-or-restart --marked will trigger a restart on the docker service which is surprising to say the least.

here are the steps you can use to reproduce the issue:

dnf install docker-ce-29.1.5-1.el9
systemctl enable --now docker
systemctl stop docker docker.socket
dnf install docker-ce-29.2.0-1.el9
systemctl start docker
systemctl show docker --property=Markers
systemctl reload-or-restart --marked

Reproduce the issue with the listed dnf and systemctl sequence, starting with the docker-ce upgrade and service lifecycle commands. Inspect how the package upgrade leaves the docker service marked for restart; done means starting the stopped service after upgrade clears that state and systemctl reload-or-restart --marked does not trigger a surprise restart.