feat: make validate() own every shape emit() reads

[lesnik512]

Closes the validate/emit seam. Several structural shapes that graph/healthcheck/emit read were never checked by validate(), so a malformed document crashed with a raw AttributeError/ValueError (the CLI's except UnsupportedComposeError misses those) or was silently mis-emitted. Now the shape-reading functions refuse malformed input and validate() exercises them, so every bad document is refused loudly at the gate.

Robust readers (UnsupportedComposeError, own their contract):

• graph.depends_on — reject a non-list/non-mapping depends_on and a mapping entry whose value isn't a mapping.
• graph.hostnames (via _host_names) — reject non-string hostname/container_name and a per-service networks that isn't a list or mapping (long-form values that aren't mappings still contribute no aliases — lenient, matching {default: null}).
• healthcheck.interval_seconds — refuse an unparseable, non-finite, or overflowing interval ("1h30m", .inf, .nan, "1e400") instead of raising ValueError/OverflowError. Supported forms: 30s, 2m, 500ms, bare seconds (no grammar expansion).

Gate (parsing.py): rejects a non-mapping healthcheck and a non-string/list tmpfs; validate() now calls hostnames(services) and the per-service interval_seconds so all six holes surface at the gate.

Behavior-preserving for valid input (existing tests unmodified). Design/rationale: planning/changes/2026-07-10.01-validate-owns-emit-shapes.md; promoted into architecture/supported-subset.md.

Tests: 216 passing at 100% line coverage; just lint-ci clean.

🤖 Generated with Claude Code