feat: Phase 0 — manifest_validator, compose YAML safety check, cap_add allowlist, backend denylist, provision hook enforcement, size cap

Introduces api/manifest_validator.py as a single security chokepoint
imported by both ServiceComposer and ServiceStoreManager:

- validate_manifest(): rejects kind=builtin, reserved container names,
  reserved subdomains, backend denylist (localhost, cell-api, etc.),
  cap_add outside allowlist / in denylist, shell-string provision hooks,
  and env values with shell-special characters
- validate_rendered_compose(): walks the rendered YAML and rejects
  privileged:true, host network/pid/ipc/userns, absolute bind mounts,
  denied capabilities, devices key, apparmor/seccomp unconfined, and
  string-form command/entrypoint (shell-injection vector)
- validate_provision_hook(): requires argv list form, lowercase binary,
  rejects NUL bytes

ServiceStoreManager changes:
- _validate_manifest() delegates to validate_manifest() after existing checks
- _fetch_manifest() and fetch_index() now stream with a 256 KB size cap
  (prevents memory exhaustion from a malicious or compromised index)
- Digest-pin warning for images missing @sha256 (hard error for unknown
  registries, warning for git.pic.ngo/roof/* and TRUSTED_IMAGES_NO_DIGEST)

ServiceComposer changes:
- write_compose() calls validate_rendered_compose() before any disk write
  so no partial file is left if validation fails
- render_template() substitutes ${PIC_DATA_DIR} with the resolved data_dir path

102 new tests in tests/test_manifest_validator.py covering all five P0
security issues.  Existing test mocks updated to use streaming response
pattern (stream=True + raw.read) and valid compose YAML templates.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/service_composer.py

@@ -23,8 +23,11 @@ import secrets as _secrets_lib
 import shutil
 import subprocess
 import threading
+from pathlib import Path
 from typing import Dict, List, Optional
 
+from manifest_validator import validate_rendered_compose
+
 logger = logging.getLogger('picell')
 
 _SECRET_RE = re.compile(r'\$\{(PIC_SECRET_\w+)\}')
@@ -136,6 +139,7 @@ class ServiceComposer:
         result = result.replace('${PIC_DOMAIN}', domain)
         result = result.replace('${PIC_CELL_NAME}', cell_name)
         result = result.replace('${PIC_SERVICE_ID}', service_id)
+        result = result.replace('${PIC_DATA_DIR}', str(Path(self.data_dir).resolve()))
 
         # PIC_SECRET_* — generate on first use, reuse on reconfigure
         for match in _SECRET_RE.finditer(template_content):
@@ -150,6 +154,14 @@ class ServiceComposer:
         """Render and atomically write the per-service compose file. Returns rendered content."""
         os.makedirs(self._svc_dir(service_id), exist_ok=True)
         content = self.render_template(service_id, manifest, template_content)
+
+        # Validate before any file I/O so a bad template never touches disk.
+        ok, errs = validate_rendered_compose(content)
+        if not ok:
+            raise ValueError(
+                f'Compose template failed security validation: {"; ".join(errs)}'
+            )
+
         path = self._compose_path(service_id)
         tmp = path + '.tmp'
         with open(tmp, 'w') as f: