Summary

• Renames emit.py's _run_tokens to run_tokens — package-internal but directly testable, matching the existing precedent of referenced_variables/command_tokens/entrypoint_tokens in the same file (none are in __all__).
• _run_tokens held the real subtlety of how entrypoint and command compose (string-form entrypoint drops the service command; list-form prepends only its first token as --entrypoint; a --command override lands positionally after the entrypoint's tokens) — yet no test imported it. Every ordering assertion went through emit_script() and searched the rendered, shell-quoted script for substrings and .index() positions.
• Adds TestRunTokens: 5 tests asserting directly on the returned list[Token]. These pin strictly more than the tests they replace — they can see the Expand vs plain-str token distinction that string-search structurally cannot, which is what makes referenced_variables correctly exclude --command override vars.
• Removes 4 of 5 full-script string-search ordering tests, keeping test_command_override_still_applies_with_entrypoint as the end-to-end smoke test (it exercises both _render branches). No rendering-coverage gap: list-form entrypoint quoting stays pinned by an untouched test, and 10 integration scenarios execute the real generated scripts under podman.
• Notable subtlety handled: _plan had a local variable and _emit_target a parameter both named run_tokens; making the function public without renaming them would have caused a genuine UnboundLocalError. Both are now tokens.
• No behavior, signature, or return-type change. Candidate feat: accept compose x- extension fields #4 from the 2026-07-13 architecture review (following Derive extends' merge policy from KeySpec #47/Adopt planning-convention v1.1.2 and migrate planning docs #2 and Give keys.py's cross-module primitives a real interface #49/Port the compose-to-podman-pod converter into compose2pod #1).

Full rationale: planning/changes/2026-07-13.08-public-run-tokens.md.

Test plan

• just test-ci — 407 passed, 100% line coverage
• just lint-ci — clean
• Task-scoped subagent review — approved, no findings (hand-traced all 5 new expected token lists against the implementation)
• Final whole-branch subagent review — ready to merge; its one Minor finding (a unit-level entrypoint_tokens([]) == [] assertion that didn't migrate) is fixed in b0db043