feat: support pod-level dns and sysctls on podman pod create

[lesnik512]

Summary

Support dns, dns_search, dns_opt, and sysctls by hoisting them onto podman pod create — the tool's first pod-create flags (every prior feature added podman run flags). A new module compose2pod/pod.py aggregates these per-service compose declarations across the target's dependency closure into the single pod. This is the deferred pod-level-aggregation item from decisions/2026-07-09-sysctls-pod-level.md and deferred.md; both dns/sysctls were previously refused.

Design: planning/changes/2026-07-11.03-pod-dns-sysctls.md.

Why pod-level

A Podman pod shares one network namespace, so these options cannot be per-container: --dns is invalid on a pod-joined container, and the only settable sysctls are namespaced (net/ipc), which the pod owns. podman pod create exposes --dns/--dns-search/--dns-option/--sysctl, each documented (verified against podman-pod-create.1) as shared across all containers in the pod — their honest home.

compose	podman pod create
dns (str/list)	--dns
dns_search (str/list)	--dns-search
dns_opt (str/list)	--dns-option
sysctls (map / k=v list)	--sysctl key=value

Reconciliation

Aggregated across the target's closure (pod_create_flags(services, order)), because a service outside the closure isn't in the pod:

• dns / dns_search / dns_opt — unioned (dedup, first-seen order). These are additive /etc/resolv.conf bags; there is no single-value conflict.
• sysctls — unioned by key; two closure services setting the same key to different values is refused (conflicting sysctl ...), matching the resources.py conflict pattern. Same key + same value (including 1/"1" normalization) or different keys merge.

Values render through the existing _Expand/to_shell path, so a ${VAR} in a dns/sysctl value stays live at run time and feeds the referenced_variables() note.

Pod-wide divergence

These apply to every container in the pod, including services that didn't declare them (inherent to the shared namespace). validate() emits one warning: dns/sysctls apply pod-wide -- all containers in the pod share one /etc/resolv.conf and sysctl set.

Non-goals

Per-service DNS/sysctls (impossible in a shared-namespace pod); last-writer-wins for a sysctl conflict (refused instead).

Testing

just test-ci at 100% coverage (352 tests), just lint-ci clean, just check-planning OK. tests/test_pod.py covers each key's flag, string/list and map/k=v forms, dns union/dedup across the closure, the sysctl conflict + clean merge, and non-closure exclusion; e2e tests prove the pod-create line and the pod-wide warning. A service with no pod options emits a byte-identical podman pod create line.

An adversarial whole-branch review ran real inputs — a $(touch) dns payload is escaped by to_shell (no new injection surface despite the new pod-create line), a genuine sysctl conflict yields a clean exit 2, and a diamond int/str sysctl merges correctly.

Planning

Retires the dns/sysctls entries in deferred.md (triggers met) and adds a Resolved note to decisions/2026-07-09-sysctls-pod-level.md; new ## Pod-level options section in architecture/supported-subset.md.