fix: hold candidate traffic and workers until migration commit

docker-compose.migration.yml

@@ -4,6 +4,7 @@
 name: vacatureradar-managed
 services:
   app:
+    network_mode: ${MIGRATION_NETWORK:?exact original network required}
     labels:
       io.itworx.migration-attempt: ${MIGRATION_ATTEMPT:?journaled migration attempt required}
     image: ${MIGRATION_IMAGE:?set an attempt-specific candidate image}