[codex] Align native Compose parity with pinned upstream

[jooh]

Summary

This change closes several native Docker Compose parity gaps against the pinned upstream devcontainers/cli baseline.

What changed

• aligned Compose up behavior with upstream defaults
  • prefer docker compose and fall back to docker-compose
  • resolve default compose files when dockerComposeFile is []
  • start all services by default when runServices is unset
  • use --no-recreate when reusing or expecting an existing Compose container
  • default Compose remote workspace folder to / when workspaceFolder is omitted
• aligned Compose override generation with upstream
  • preserve the first-file version: prefix
  • emit the keepalive wrapper entrypoint
  • honor merged entrypoints and overrideCommand
  • declare named volumes at the top level
  • carry CLI --mount values through the Compose override path
• aligned Compose build behavior with upstream where supported
  • accept --cache-from by generating a Compose build override file
  • continue rejecting unsupported Compose build flags in the same areas upstream rejects them: --cache-to, --output, --platform, and --push
• added repo-owned documentation for the remaining Compose-specific gaps in docs/upstream/compose-parity.md

Why

The native runtime had broadened static command-matrix coverage, but still diverged from upstream in several Compose-specific runtime and build paths. The biggest gaps were ignored CLI mounts in Compose up, weaker override-file generation, and rejecting upstream-supported Compose --cache-from behavior.

Impact

• Compose-backed workspaces now behave much closer to upstream for up and build
• native parity tests cover the previously missing Compose paths
• the remaining Compose divergences are now explicit and documented instead of implicit

Remaining documented gaps

See docs/upstream/compose-parity.md for the current inventory. The notable remaining items are:

• project-name .env lookup still differs from upstream
• native Compose metadata still comes from raw YAML inspection rather than docker compose config
• the keepalive wrapper does not yet fall back to image Entrypoint / Cmd
• Compose build --label is still unsupported natively

Validation

• cargo test --manifest-path cmd/devcontainer/Cargo.toml --test runtime_container_smoke
• make rust-tests
• cargo test --manifest-path cmd/devcontainer/Cargo.toml --test runtime_build_smoke compose:: -- --nocapture
• make tests