refactor: introduce keys.py service-key registry (validate + emit derive from one table)

[lesnik512]

Behavior-preserving refactor. Collapses the three hand-synced enumerations of the declarative service keys into one deep module, compose2pod/keys.py — a service-key registry (SERVICE_KEYS: dict[str, KeySpec], each a (validate, emit) pair). parsing.validate() and emit.run_flags() now each derive the ~16 keys from one loop instead of maintaining parallel SUPPORTED_SERVICE_KEYS / shape-tuple / _*_FLAGS lists.

• keys.py owns the token vocabulary (Token/_Expand/_key_value_pairs/PULL_POLICY_MAP, moved from emit.py) plus SERVICE_KEYS (16 declarative keys) and STRUCTURAL_KEYS. Uniform shapes bind shared functions (_scalar/_bool/_list/_map); bespoke keys (extra_hosts/pull_policy/ulimits) supply their own bodies.
• SUPPORTED_SERVICE_KEYS = set(SERVICE_KEYS) | STRUCTURAL_KEYS — derived, so a new declarative key is one entry.
• Import direction fixed: emit/parsing import the neutral keys.py; the old validator-imports-emitter inversion is gone.
• Drift guards (tests/test_keys.py): registry/structural disjointness + a SUPPORTED_SERVICE_KEYS snapshot. Plus a cross-key emission-order lock test.
• Docs: architecture/supported-subset.md interpolation list corrected (was stale by ~8 keys, now anchored to the registry); architecture/glossary.md seeds the vocabulary (service-key spec, service-key registry, structural key).

Design/rationale: planning/changes/2026-07-09.08-service-key-registry.md.

Tests: 201 passing at 100% line coverage; just lint-ci clean. Existing per-key tests unchanged (the correctness proof for a behavior-preserving refactor). One null-handling regression (a plan bug that briefly tightened pull_policy: null / ulimits: null) was caught in review and fixed to preserve the prior leniency, with regression tests.

🤖 Generated with Claude Code