v0.6.21

kern 0.6.21

Compose compatibility, measured against 109 real docker-compose.yml files (all
of docker/awesome-compose plus Airflow, Sentry, Supabase, Appwrite, Kafka,
Temporal, Immich, Mastodon, GitLab, Nextcloud, Grafana, MinIO, Keycloak, Odoo,
Drupal, Moodle, Saleor, Vendure, Windmill, Dify, Directus and the rest: 12,111
lines) and against `docker compose config` itself rather than against an
assumption. That comparison is what found the last defect, after I had already
written the opposite conclusion.

95 of the 109 now parse as they are, up from 90. Of the 14 that do not, 5 are
refused by Docker too, 7 are pod port collisions that `--no-pod` accepts, and 2
diverge on purpose.

Added
  - A container-only port is accepted, as a DECLARED port. `ports: ["8000"]` and
    `ports: ["${UNSET}:8000"]` were refused; Docker normalises both to target
    8000 with no published port and assigns an ephemeral one at up. kern has no
    ephemeral allocator, and inventing one would publish a port the file never
    named on a number nobody can predict, so the entry joins the pod-wide space
    `expose:` and `port:` already feed, with a warning saying so. Supabase,
    Budibase, Jitsi and OpenCTI reach this form through an unset variable.

Fixed
  - A `depends_on` typo was silently dropped: the pruning loop removed every
    absent name, so the topological sort never saw it. A name skipped by an
    inactive profile is still pruned; one never defined is now refused and
    quoted, as Docker refuses it.
  - An `image:` beginning with `-` was accepted by compose while the docker shim
    refused the identical string as flag injection.
  - A per-service `networks:` with no top-level block passed in silence, and
    then said the same thing once per service. Stated once per run.
  - "`services:` is empty" was the answer for a file with ten services, all
    behind inactive profiles. Right outcome, wrong noun.
  - An empty file was answered with a TOML noun for a document saved as .yml.
  - The installer gave up on a WSL2 distro whose curl uses c-ares and whose AAAA
    lookup stalls. One IPv4 retry, saying why. `kern pull` was never affected.
  - examples/benchmark.py took over ten minutes: 1000 runs per runtime is three
    seconds for kern and five minutes for docker. 118 s now, same numbers.
  - Fourteen examples slept a fixed second waiting for a box that was already
    up. They poll the condition now: copy-files 1041 ms to 35, serve-with-port
    5500 to 231.

637 Rust tests, 61 Python, 50 Node. clippy clean. 79 examples green.