feat: add manifest_validator.py — security chokepoint for compose and manifest validation

Rejects privileged compose configs (network_mode:host, pid:host, ipc:host,
userns_mode:host, cap_add:ALL, string commands, missing cell-network,
reserved container names). Validates manifest schema_version=3, image
digest pinning (sha256 required, :tag-only rejected), and provision hook
format. Wired into ServiceComposer.write_compose() and
ServiceStoreManager.install() as a single enforcement point.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_optional_services_feature.py

@@ -58,6 +58,9 @@ def _store_manifest(service_id, subdomain=None, backend=None):
     return m
 
 
+_FIXTURE_DIGEST = 'a' * 64
+
+
 def _ssm_manifest(service_id='myapp', **overrides):
     """Minimal manifest that passes ServiceStoreManager._validate_manifest."""
     m = {
@@ -65,7 +68,7 @@ def _ssm_manifest(service_id='myapp', **overrides):
         'name': 'My App',
         'version': '1.0.0',
         'author': 'Test Author',
-        'image': f'git.pic.ngo/roof/{service_id}:latest',
+        'image': f'git.pic.ngo/roof/{service_id}@sha256:{_FIXTURE_DIGEST}',
         'container_name': f'cell-{service_id}',
     }
     m.update(overrides)