Some version ago the fpm service unit was hardened, beside others,
it uses ProtectSystem=full, which makes /etc read-only, but alternatives
helper script requires RW access to /etc/alternatives/. The
"2>/dev/null" hides it, thus it is relative hard to find the reason, after
i commented that redirection, the journal reveals reason (sorry, in Slovak):

    php-fpm-socket-helper[57928]:  update-alternatives: chyba: nedá sa odstrániť \
        „/etc/alternatives/php-fpm.sock.dpkg-tmp“: Súborový systém dovoľuje len čítanie

By that, after boot or after delete, the default socket symlink is not
(re)created on unit (re)start.

I fixed by creating drop-in, to allow write access to that directory:

    [Service]
    ReadWritePaths  = /etc/alternatives/

Please, remove that stderr redirection it makes things more hard, and when
all is OK, no stderr output is produced by udpate-alternatives.

Please add that path to RW paths, as it is not local settings...

regards