ci: Bump docker/login-action from 3 to 4 - #96

* deps: bump the pending Go module updates

Folds the six open dependabot module bumps into one change, taking the
latest release of each rather than the version each PR was cut against:

- compose-spec/compose-go/v2 2.11.0 -> 2.14.0 (#112)
- google/go-containerregistry 0.21.7 -> 0.22.0 (#113 asked for 0.21.9)
- moby/moby/api 1.54.2 -> 1.55.0, moby/moby/client 0.4.1 -> 0.5.1 (#100)
- golang.org/x/term 0.43.0 -> 0.45.0 (#110)
- google.golang.org/protobuf 1.36.11 -> 1.36.12 (#114)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* ci: bump the pending GitHub Actions updates

All four are majors whose breaking changes are the Node 24 runtime
default and an ESM migration; the workflows pass no inputs that the
majors removed, and no workflow uses pull_request_target or
workflow_run, which is the trigger pair actions/checkout v7 newly
refuses to check out fork PRs for.

- actions/checkout v6 (ci.yml) and v4 (devcontainer-*.yml) -> v7 (#99)
- actions/setup-go v6 -> v7 (#111)
- docker/login-action v3 -> v4 (#96)
- docker/setup-buildx-action v3 -> v4 (#95)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(compose): refuse the compose lifecycle hooks on the native path

compose-go 2.14 adds ServiceConfig.PreStart, so `pre_start` — which
2.11 rejected at schema validation — now loads cleanly. The native
orchestrator creates the service container directly and has no
ephemeral init-container step, so it dropped the hook silently; and
because the hooks are part of the ServiceConfig that ConfigHash
covers, editing a hook that never ran read as a config change and
stopped and removed the running container, destroying its writable
layer.

Refused in Plan.Validate via the existing §2.2 unsupported-field
mechanism, before any infrastructure side effect. stripForHash drops
the three fields as well: the refusal already makes them unreachable
there, but a recreation is unrecoverable, so no field the orchestrator
does not execute should be able to trigger one if the refusal moves or
a caller reaches ConfigHash directly.

post_start and pre_stop parsed cleanly under 2.11 and had the same
defect, so all three are refused rather than just the one the bump
introduced. The shell-out backend is untouched — it delegates to
`docker compose`, which implements the hooks.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(compose): refuse unsupported fields before building anything

The §2.2 refusal ran only inside Orchestrator.Up, which the engine
reaches after prepareComposeServiceImage, layerFeatures and
buildComposeSidecarImages. A native project using a refused field
therefore paid for the primary image and every sidecar build, and
left those images tagged, before being told the engine will not run
it.

Plan.Validate already documents itself as side-effect-free and safe
to call before any backend interaction, so the fix is to call it
where that matters: straight after compose.Load. The orchestrator's
own validation stays as the authoritative one.

Native backend only. The shell-out path hands the project to
`docker compose`, which implements hooks and other fields the native
orchestrator refuses, so validating there would reject projects that
work today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: bilby91 <2201079+bilby91@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>