Implement perry/container and perry/container-compose modules

[yumin-chen]

Implementation of the perry/container and perry/container-compose TypeScript modules. This includes a complete Rust reimplementation of OCI-compatible container orchestration, a generic backend architecture, and full compiler integration.

Major components:

1. perry-container-compose Crate: A standalone library and CLI providing Docker Compose-like functionality with automatic runtime detection and full compose-spec support.
2. Standard Library Expansion: New FFI bridge in perry-stdlib that exposes container lifecycle and orchestration functions to TypeScript.
3. Compiler Integration: Updated HIR lowering and codegen to recognize the new native modules and emit efficient LLVM call instructions.
4. Security & Verification: Built-in support for Sigstore/cosign verification and Harden Chainguard base images for shell capabilities.
5. Testing: Over 30 unit and property tests verifying topological sort, YAML/JSON round-trips, name generation, and registry safety.

---

PR created automatically by Jules for task 9089138075552882678 started by @yumin-chen

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[yumin-chen]

What are the image operations API do we have enough for exist? and pull? image operations must be explicit in the examples -- any image pulling must be explicily done and ContainerUp is not enough

[google-labs-jules]

What are the image operations API do we have enough for exist? and pull? image operations must be explicit in the examples -- any image pulling must be explicily done and ContainerUp is not enough

I have implemented pullImage, listImages, and removeImage in the perry/container module. I've also updated the examples/forgejo-deploy.ts script to include explicit pullImage calls for both Forgejo and PostgreSQL images before calling composeUp, as requested. composeUp (and the underlying ComposeEngine) will still attempt to pull images if they aren't present, but explicit pulling is now the recommended pattern in the examples.

[yumin-chen]

Submit your changes when ready. Are you ready?