feat: add run subcommand and Compose resource limit support

[dodyirawan85]

Summary

Adds container-compose run for one-off service commands, and maps Compose
resource options onto Apple Container flags for up, run, and build.

Changes

Resource limits (ResourceArguments)

• Parse cpus, mem_limit, mem_reservation, shm_size, tmpfs, ulimits
  (short + {soft, hard} forms), plus deploy.resources limits/reservations.
• Map to --cpus, --memory, --shm-size, --tmpfs, --ulimit.
• Official deploy.resources values win over legacy shorthands; conflicts and
  unsupported keys (soft reservations, device/GPU reservations, replicas) are
  reported as notes.
• Fractional CPU requests round up (Apple Container takes whole CPUs).
• Wired into up, run, and build.

run subcommand

• container-compose run [OPTIONS] SERVICE [COMMAND...] with the trailing
  command overriding the service command.
• Flags: -d/--detach, --rm, --no-deps, -P/--service-ports, -p, -e,
  -v, -u, -l, --entrypoint, --name, --build, --no-cache,
  -T/--no-tty, --env-from-file.
• Service ports are withheld unless --service-ports/-p is given.
• depends_on services are started detached first unless --no-deps.
• Attaches the terminal in-process via Apple's ContainerRun, so interactive
  shells get correct TTY/raw-mode/stdin handling and exit codes propagate.
• --rm reclaims a stale same-name container; without it a clear
  containerNameTaken error is raised.
• Honors extra_hosts via a generated, per-run hosts file bind-mounted over
  /etc/hosts (Apple Container has no --add-host flag); the file is removed
  after foreground runs and stale ones are swept by down.

Misc

• Refreshed Healthchecked Redis sample: explicit project name (the sample
  directory contains a space) and official resource limits.

Testing

• swift test --test-product Container-Compose-StaticTests: 266 tests pass,
  including new ComposeRunTests and ResourceOptionsTests.
• Manual verification: command override, dependency startup, --rm name
  reclaim, and container inspect confirming cpus/memory/shm/tmpfs/ulimits
  (e.g. cpus: "1.5" → 2 with a rounding note).

Notes / Limitations

• Apple Container has no soft reservations, device/GPU passthrough, or
  replicas; these are ignored with notes.
• run has no container -w/--workdir override (--workdir stays the local
  working directory); set working_dir in the compose file.