fix(compose): forward published ports (#19) and accept -f before subcommand (#21)

[us]

Fixes two independent, verified compose bugs. Plan was produced and adversarially reviewed via a multi-agent loop; both root causes confirmed against source.

#19 — compose up never forwards published ports (ECONNREFUSED)

buildRunArguments never emitted -p/--publish. Forwarding relied on a user-space PortProxy that only started when container inspect already reported an IP — but right after container run -d the guest IP is unassigned, so the proxy never started and the failure was swallowed by try?. Every published port returned ECONNREFUSED.

Fix: emit native -p host:container/proto (Apple's container CLI supports [host-ip:]host-port:container-port[/protocol], verified on 0.12.3) and stop relying on the proxy. portProxy.stop is retained on stop/remove to clean up proxies left by older versions. PortMapping.parse now also accepts ip:host:container and bare-container forms. Also fixes mocker run -p, which shared the same path.

#21 — compose -f a.yaml -f b.yaml pull → "Unknown option '-f'"

ComposeOptions is an @OptionGroup on each subcommand, so swift-argument-parser only accepts -f/-p after the subcommand token, while Docker places them before it. -f was also single-valued.

Fix: ComposeArgNormalizer relocates pre-subcommand -f/--file/-p/--project-name to after the subcommand (invoked from a custom MockerCLI.main before parsing); file: String? → files: [String]; new ComposeFile.merge for ordered multi-file overlay (later overrides earlier; environment/labels field-merge). Flags after the subcommand and single-file usage are unchanged.

Verification

• swift build + swift test: 99/99 pass (new unit tests for -p emission, port grammar, argv reordering, and multi-file merge).
• E2E: mocker compose -f base.yaml -f dev.yaml config now works and correctly merges (overlay image wins, base ports preserved, env merged) — previously errored.
• mocker compose does not forward published ports to host (ECONNREFUSED) #19 forwarding chain: reporter empirically confirmed native container run -p is host-reachable; unit test confirms mocker now emits exactly that.

Closes #19
Closes #21