feat(compose): emit validation receipts as JSON

[tang-vu]

?## Summary

• add --json to the shipped Compose stack validator
• report a stable validity receipt, selected Compose engine, service count, and error code
• keep detailed Compose diagnostics on stderr so stdout remains parseable
• add explicit help without changing default or quiet output

Why this matters

Installers and CI already call validate-compose-stack.sh at the point where layered Compose files become a deployable stack. Machine-readable receipts let automation distinguish missing Compose, invalid input, and invalid merged configuration without scraping prose or storing the fully rendered Compose document.

Behavioral invariant: validation still delegates to the exact shipped Compose engine and returns non-zero whenever compose config fails.

Overlap check

Searched open and closed PRs for validate-compose-stack, validate compose JSON, compose stack JSON, and the production file. PR #2630 adds structured resolution plans to resolve-compose-stack.sh; PR #3259 adds deployed-stack drift attestation. Neither exposes the validation result from validate-compose-stack.sh, so this is a separate handoff boundary.

Test plan

• bash -n ods/scripts/validate-compose-stack.sh
• bash ods/tests/test-validate-compose-json.sh
• bash ods/tests/test-extension-integration.sh (39 passed, 1 environment skip)
• git diff --check

The boundary test invokes the real validator with a Docker Compose shim, validates exact success JSON, then forces compose config failure and verifies stderr detail, stable error code, and exit 1.

Security, portability, and rollback

Rendered Compose output may contain expanded configuration, so JSON intentionally carries only a normalized error code; diagnostic text stays on stderr under the existing operator policy. Linux/macOS use the same Bash path and Windows uses WSL. Removing --json cleanly restores the prior interface.

Generated with Codex

Batch compatibility

This PR is independently mergeable. For the September feature batch, the tested order is #3647 ? #3656. All ten heads cherry-picked without conflict onto upstream/main@6ff9b4fc; the resulting synthetic integration head was 17e0791c.

Combined validation: all focused boundary suites passed, make lint passed, and every GitHub Actions check on all ten PRs passed. make test reaches the pre-existing Hermes template bounds each model turn failure; the same command/failure was reproduced on a clean upstream/main@6ff9b4fc worktree. No live hardware, physical-print, archive/restore, or deployment claim is inferred from static/simulated validation.