feat: tell the user podman's reason in the four refusals that kept it

[lesnik512]

Closes #121.

ADR-0006 says the rule-two/limitation distinction is "held apart in the refusal messages as well as here". The issue's comment enumerated the four messages where it was not: each is measured by a REFUSALS row proving podman will not make the mount, so the reason exists and was simply never told to the user.

message before	message now
anonymous volume 'a' must be an absolute path	... (podman refuses a container path that is not absolute)
volume 'target' must be an absolute path	... (podman refuses a container path that is not absolute)
volume 'type' must be one of ['bind', 'volume', 'tmpfs', 'image'] (for cluster/npipe)	volume 'type: cluster' is not supported (podman cannot express it)

The two drive-qualified-bind rows are untouched, as the issue's comment ruled: the limit there is the short form's, not podman's, and the message already says so.

Why the type pair is a split, not a suffix

volume 'type' must be one of [...] fires for two opposite reasons:

$ docker compose config   # v5.1.2, measured locally
type: cluster  ACCEPT
type: npipe    ACCEPT
type: bnid     REJECT  (value must be one of 'bind', 'volume', 'tmpfs', 'cluster', 'npipe', 'image')

cluster/npipe are rule two -- docker takes them, podman has no such mount. bnid is rule one -- docker refuses it and podman is not involved. A blanket podman clause would have claimed podman refuses a typo. So _DOCKER_ONLY_VOLUME_TYPES is checked first and the rule-one message keeps saying nothing about podman, which a test asserts directly ("podman" not in str(refusal.value)).

Both verdicts are now standing measurements rather than a note in a PR body: corpus/volume_long_form_cluster_type.yaml is pinned as a catalogued over-rejection and corpus/volume_long_form_misspelled_type.yaml as both-reject. Citing podman is only legitimate while docker itself accepts the document, and that is the oracle that says so.

Keeping the list empty

The claim-coverage gate from #125 scans compose2pod/podman.py attribute access, so it was structurally blind to these four: a message that cites nothing has no claim to scan. The new invariant closes that from the table's side --

def test_every_refusal_podman_agrees_with_tells_the_user_podmans_reason() -> None:
    silent = sorted(row.id for row in REFUSALS if not row.claim)
    assert silent == []

-- because a REFUSALS row's own premise is that podman will not make the mount. A refusal with no podman reason belongs in LIMITATIONS, where the two drive-qualified binds sit. Run before the fix it named exactly the four rows the issue enumerated, which is the proof that it bites:

E       AssertionError: anonymous-volume-relative-target refuses for podman's reason without telling the user
E         long-form-relative-target refuses for podman's reason without telling the user
E         long-form-type-cluster refuses for podman's reason without telling the user
E         long-form-type-npipe refuses for podman's reason without telling the user

Verified

• just test-ci: 1436 passed, 100% line coverage.
• just lint: ruff format, ruff check, ty all clean.
• pytest -m conformance against real docker compose config v5.1.2: 871 passed, over-rejections now 8 (the new cluster file joins the catalogue), residuals unchanged at 2.
• Every REFUSALS/LIMITATIONS/ABSENT_FLAGS/STUB_FLAGS row's refusal_match re-checked against the live message.
• The podman half of the integration job is the one thing not runnable here -- podman is not installed locally, so this is a draft until the integration job on ubuntu-24.04 (podman 4.9.3) reports. The probe argv for these rows is unchanged; only the refusal_match strings moved.