Improve Apple container compose compatibility

[thromel]

Summary

This improves compatibility with Apple container for several Compose workflows:

• decode depends_on map form and preserve dependency conditions
• wait for service_started, service_healthy, and service_completed_successfully
• parse service networks object form, including aliases
• emit Apple network alias properties when the linked Apple container command parser supports them, while preserving a warning/skip fallback for Apple Container 1.0.0
• warn and skip Compose hostname: because Apple container run 1.0.0 does not currently expose a hostname flag; proposed upstream support remains under discussion in Add container run hostname flag apple/container#1811
• execute supported healthchecks (CMD and CMD-SHELL) with interval/start-period/retry handling
• create and mount named volumes through native container volume support instead of rewriting them into host paths
• surface failed detached container run commands as errors, which makes one-shot failures fail compose up

Related issues: #52, #115, #116, #117, and tracker #118.

Apple-side service discovery work is tracked upstream in apple/container#1809. Current upstream PR chain:

• Normalize network hostname lookup apple/container#1810: normalized/trailing-dot hostname lookup, signed and ready for review
• Add container run hostname flag apple/container#1811: optional native container run --hostname, signed and under maintainer discussion; aliases may cover most Compose cases
• Add DNS forwarding groundwork apple/container#1813: DNS forwarding/message groundwork only; container-facing listener startup was removed after vmnet gateway bind validation failed
• Add network attachment aliases apple/container#1815: network attachment aliases via --network name,alias=..., signed, closes [Request]: Add network-scoped aliases for container network attachments apple/container#1839

Testing

Static/build checks:

git diff --check
swift build
swift test --filter EntrypointCommandTests
swift test --filter Container_Compose_StaticTests --skip WaitForeverCpuTests

The static test command passed 141 tests. WaitForeverCpuTests was skipped because the existing CPU-threshold test is noisy on this machine and unrelated to these changes.

Manual Apple container smoke tests using the locally built Container-Compose binary:

• one-shot success dependency completes and unblocks dependent startup
• one-shot failure exits nonzero and fails up -d
• native named volume persists data and can be read from a separate container run
• service network object form attaches to the requested network and emits an alias fallback warning against Apple Container 1.0.0
• passing healthcheck unblocks dependent service startup
• failing healthcheck prevents dependent service startup
• service with hostname: emits a warning, does not pass unsupported --hostname, and completes successfully (HOSTNAME_OK logged)

All dynamic test containers, networks, and volumes were cleaned up after the runs.