feat(run): forward decrypted secrets into docker compose env_file services

[cvince]

Problem

Laravel/Docker test feedback (Finding 1): capy run -- docker compose up with the standard env_file: .env boots containers with ciphertext (CACHE_DRIVER=capy:… → Laravel crash). Containers don't inherit compose's environment; env_file reads the encrypted file off disk.

Fix

When the command is docker compose … / docker-compose …, capy run now:

1. Asks docker compose config --format json --no-interpolate which services have env_file pointing at the Capy .env (no YAML parsing on our side).
2. Builds a names-only override: {"services":{"app":{"environment":["APP_KEY","DB_PASSWORD"]}}}. A bare name tells compose to forward the value from its own env, which capy run populated.
3. Re-runs as docker compose -f <user files> -f /dev/fd/3 …, piping the override on fd 3 (stdin stays free for run/exec/tinker). Windows has no /dev/fd, so it uses a names-only temp file deleted on exit.

No values are ever written anywhere. Services that don't read .env (db, phpmyadmin) get nothing. User's own -f flags, COMPOSE_FILE, and the default *.override.yml are preserved. Anything ambiguous (e.g. --project-directory without -f, config failing) leaves argv unchanged.

Not covered

• docker inspect still shows plaintext in the container config (inherent to host-side decryption).
• Recreating containers outside capy run still gets ciphertext.
• php artisan config:cache (Finding 3).

Testing

• tests/commands/composeForward.test.ts: arg parsing, file resolution, service filtering, POSIX pipe + Windows temp file.
• Manual with Docker Compose 2.31: run and up → app gets SECRET=plaintext, a service without env_file gets nothing.
• bun run build && bun run test: 2415 pass, 0 fail. Typecheck clean.