fix: complete reset recovery safety

internal/dockerclient/dockerclient.go

@@ -358,6 +358,19 @@ func (a *Adapter) disable() error {
 	if err != nil {
 		return err
 	}
+	if err := validateManagedProxyStrings(defaults); err != nil {
+		return err
+	}
+	currentFingerprint := fingerprintCurrent(config)
+	if currentFingerprint == fingerprintOriginal(metadata) {
+		if err := a.files.Remove(a.configuration.RecoveryFile); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			return fmt.Errorf("clean Docker client recovery metadata for already-restored proxy defaults: %w", err)
+		}
+		return nil
+	}
+	if currentFingerprint != metadata.Fingerprint {
+		return errors.New("Docker client managed proxy defaults changed after proxyctl applied them; refusing to overwrite current configuration or discard recovery metadata")
+	}
 	for _, key := range managedKeys {
 		prior := metadata.Original[key]
 		if prior.Present {
@@ -533,6 +546,19 @@ func fingerprintDefaults(values map[string]string) string {
 	return fingerprintSnapshot(snapshot)
 }
 
+func fingerprintOriginal(metadata recovery) string {
+	snapshot := make(map[string]managedValue, len(managedKeys))
+	for _, key := range managedKeys {
+		prior := metadata.Original[key]
+		value := managedValue{Present: prior.Present}
+		if prior.Present && json.Unmarshal(prior.Value, &value.Value) == nil {
+			value.Valid = true
+		}
+		snapshot[key] = value
+	}
+	return fingerprintSnapshot(snapshot)
+}
+
 func fingerprintCurrent(config map[string]json.RawMessage) string {
 	snapshot := make(map[string]managedValue, len(managedKeys))
 	proxies, _, proxyErr := childObject(config, "proxies")