chore(reranker): harden A3/A4 backends restart=unless-stopped (reboot survival)

A3 now backs the prod reranker alias but was launched --restart no;
docker update to unless-stopped so an ana-ml2 reboot can't silently
break the alias. Full compose-service promotion tracked as a follow-up
in the selection ledger.

docs/pfi/reranker-selection-ledger.md

@@ -201,9 +201,11 @@ on ana-ml2; `/model/delete` the two aliases (DB-persisted); weights retained in
 - **A2 (`vllm-rerank-a2` :8012)** + alias `reranker-a2-qwen3-seqcls` — bench-only, tear down when
   Brokkr signals the bake-off is closed (`docker stop/rm` + `/model/delete`).
 - **A4 (`vllm-rerank-a4` :8014)** + alias — KEEP for now (Brokkr's documented throughput fallback).
-- **A3 (`vllm-rerank-a3` :8013)** — now PRODUCTION (backs the `reranker` alias). Promote from
-  throwaway `docker run` to a durable compose service when the dust settles (currently `--restart
-  no`, so it will NOT survive an ana-ml2 reboot — **follow-up: make A3 durable**).
+- **A3 (`vllm-rerank-a3` :8013)** — now PRODUCTION (backs the `reranker` alias). Hardened
+  2026-08-06: `docker update --restart unless-stopped` (survives ana-ml2 reboot, no recreate).
+  A4 given the same. **Remaining follow-up (not urgent): promote A3 from throwaway `docker run`
+  to a canonical compose service** (`stacks/vllm/`) for config-managed consistency — a recreate,
+  so do it in a window since it briefly drops `reranker`.
 - **Incumbent (`vllm-rerank` :8002)** — keep up as rollback until Brokkr/worldtree close the
   post-cutover watch; retire (not delete) only on explicit sign-off.
 - **`rerank_hybrid_floor`** — Brokkr routing to worldtree-dev directly (drop, don't re-tune).