Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@cli/cmd/backup.go`:
- Around line 484-500: The sortBackups function uses sort.Slice which is
unstable; change to deterministic sorting by using sort.SliceStable and add a
secondary tie-breaker (e.g., compare backup ID) in each comparator to handle
equal Timestamp or SizeBytes cases: in the "oldest"/"newest" branches compare
Timestamp then fall back to comparing backup ID (e.g., backups[i].ID <
backups[j].ID), and in the "size" branch compare SizeBytes then fall back to
backup ID; update all sort.Slice calls in sortBackups to sort.SliceStable and
include the tie-breaker using the backupInfo.ID field.

In `@cli/cmd/doctor.go`:
- Around line 181-230: doctorAutoFix currently performs fixes inline per issue
which can cause multiple restarts and wrong ordering; change it to first scan
the issues (from classifyDoctor(report)) and set action flags (e.g.,
needComposeFix, needRestart) by checking issue strings (use same checks as
existing cases: "compose.yml" + "not found"/"invalid" => needComposeFix;
"unhealthy"/"exited" => needRestart), then perform actions in a planned order:
call doctorFixCompose once if needComposeFix, and only after regenerating (and
re-evaluating/docker.Detect if necessary) call composeRunQuiet once to restart
if needRestart and docker is available; keep using existing helpers
doctorFixCompose, composeRunQuiet, docker.Detect and preserve error reporting
via out/errOut and atomicWriteFile behavior in doctorFixCompose.
- Around line 49-50: The --checks flag currently only filters output; parse
doctorChecks into a normalized set and ensure that same set is used end-to-end:
pass the selected checks into diagnostics.Collect (or add a new parameter/filter
interface) so Collect runs only those checks, and likewise filter the input to
renderDoctorSummary and doctorAutoFix so they operate only on the selected
checks' results; update function signatures or add a small adapter that filters
the full diagnostics list returned by diagnostics.Collect before calling
renderDoctorSummary and doctorAutoFix (referencing doctorChecks,
diagnostics.Collect, renderDoctorSummary, doctorAutoFix and the doctorCmd flag
registration) so that --checks truly limits what is executed and fixed.

In `@cli/cmd/root.go`:
- Around line 241-243: The hint printing currently constructs a new UI via
ui.NewUI(rootCmd.ErrOrStderr()) which bypasses the CLI output/settings; instead
locate and reuse the existing UI/renderer that respects flags and persisted
settings (the same UI instance used to render normal output), e.g. obtain the UI
from the command/context or the shared variable used elsewhere in root command
initialization and call HintError on that instance rather than calling ui.NewUI;
update the errorHint handling code (where errorHint(err) is checked and
ui.NewUI(...) is invoked) to retrieve the existing UI (or pass it in) so
--quiet, --no-color, --plain and the persisted hints mode are honored.
- Around line 279-280: The current case branch that returns "Try --skip-verify
for air-gapped environments." for any message containing "image verification
failed" is too broad; restrict that advice to only transport-related
verification failures (the same guard used in cli/cmd/update.go) so genuine
signature/digest mismatches won't suggest skipping verification. Locate the case
handling strings.Contains(msg, "image verification failed") and change its
condition to detect transport errors (reuse the transport-error detection logic
from cli/cmd/update.go) before returning the --skip-verify suggestion; leave all
other verification failures to surface their integrity-related messages
unchanged.

In `@cli/cmd/uninstall.go`:
- Around line 30-33: runUninstall advertises a non-interactive --yes but still
invokes confirmation helpers that always prompt (blocking in non-TTY). Modify
runUninstall to pass the opts.Yes flag into each confirmation helper (or
conditionally bypass them when opts.Yes is true) used for removing volumes,
images, data, and the binary (locate calls to the confirmation helpers invoked
from runUninstall and the helpers themselves) so that when opts.Yes is true the
helpers return affirmative without prompting and the uninstall proceeds
non-interactively.
- Around line 82-88: The --keep-data flag only skips confirmAndRemoveData but
does not prevent the earlier step that runs "docker compose down -v", so
volume-backed app data can still be deleted; update the uninstall flow to check
uninstallKeepData before executing the compose down with volumes (the function
or call that runs "docker compose down -v" — locate the method that invokes
compose down/remove volumes) and short-circuit that step when uninstallKeepData
is true, and adjust the prompt/log to indicate volumes were preserved; keep the
existing confirmAndRemoveData behavior but ensure both the
compose-down/volume-removal call and confirmAndRemoveData respect
uninstallKeepData.

In `@cli/cmd/update.go`:
- Around line 345-354: The relaunched process is not receiving the CLI-only
option, so add forwarding of the "--cli-only" flag when re-execing: detect the
existing CLI-only option (the boolean/flag variable used in this file — e.g.,
updateCliOnly or updateCLIOnly) and append "--cli-only" to reArgs when it's set
(similar to how updateNoRestart, updateImagesOnly, and the timeout flag are
forwarded), ensuring the relaunched process preserves the user's CLI-only
intent.
- Around line 52-53: The flag --timeout (updateTimeout) is not being applied in
verifyAndPinForUpdate; replace the hard-coded 120s in verifyAndPinForUpdate's
context.WithTimeout(ctx, 120*time.Second) with a time.Duration derived from
updateTimeout (parse updateTimeout with time.ParseDuration), handle parse errors
(return error or default to 90s) and use that duration for the context timeout
so the verification honors the user's flag; reference updateTimeout and the
verifyAndPinForUpdate function when making this change.
- Around line 629-632: The auto-restart config (state.AutoRestart) is being
ignored in non-interactive runs because the early return for
!opts.ShouldPrompt() happens before the AutoRestart branch; move or evaluate the
state.AutoRestart check before the non-interactive default branch so that
performRestart(ctx, out, info, safeDir, state, opts.UIOptions()) is called when
state.AutoRestart is true regardless of opts.ShouldPrompt(); modify the logic
around opts.ShouldPrompt(), state.AutoRestart, and the performRestart(...) call
so flag > config > default precedence is preserved (e.g., check
state.AutoRestart first, then respect explicit --yes/ShouldPrompt behavior).

In `@cli/cmd/wipe.go`:
- Around line 70-73: The --keep-images flag (wipeKeepImages) is currently a
no-op because the wipe implementation only calls composeRunQuiet(..., "down",
"-v") and never removes images; either remove the flag/help or implement image
removal: when wipeKeepImages is false invoke composeRunQuiet (or the existing
wipe path) with the compose "down" option to remove images (e.g., add "--rmi"
"all" or the equivalent) and ensure dry-run branches reflect that behavior (and
update the paths referenced around the wipeCmd handling and any logic in the
composeRunQuiet call sites mentioned in the comment).