fix: refuse network_mode with its own pod-model reason - #119

Closes #115. The ADR correction that issue asked for landed in #112; this is the remaining half, which the issue itself set aside as "a separate change from this correction".

Before

service 'app': unsupported key 'network_mode'

That is wrong twice over. network_mode is not unsupported in the sense the message implies — podman honours --network for a container that joined a pod, measured on 4.9.3 in #115:

pod default   : lo 127.0.0.1/8 tap0 10.0.2.100/24
pod + host    : lo 127.0.0.1/8 eth0 10.1.0.168/20 docker0 172.17.0.1/16

And the real reason is invisible: honouring it is exactly what makes it unacceptable, because it moves the container out of the namespace every other service reaches it on.

After

service 'app': 'network_mode' is not supported: honouring it would move the container out of
the pod's shared network namespace, where the localhost ports and hostnames its dependents use
stop resolving

The site is a _POD_MODEL_REFUSALS table checked just before the generic unknown-key raise, with the ADR-0003 pointer in a comment above it rather than in the message.

What this deliberately does not do

links, external_links and expose still get the generic message. ADR-0003 names them in the same clause as network_mode, and the table is shaped to hold them. I left them out because their reasons are not the same sentence and I have not measured them: external_links reaches a container outside the pod, which is close to network_mode's reason, but expose does not pull anything out of anything — inside a shared namespace it is simply inert, which is a different claim and arguably makes it an IGNORED_SERVICE_KEYS entry rather than a refusal. Writing one message for all four would restate a reason I would then have to correct, which is the failure mode #115 exists to document.

Worth a follow-up issue; not worth guessing here.

Also

• test_unsupported_service_key_raises used network_mode as its example of an unknown key, which it no longer is. Switched to cgroup_parent so the generic path stays tested.
• ADR-0006 dropped its (#115) tracking pointer and gained one clause noting the distinction now reaches the user, not only the reader of the ADR.

Verification

• just lint, just test-ci: green, 100% line coverage held.
• just test-conformance against real docker compose config v5.1.2: 865 passed, 6 over-rejections — identical to the main baseline I ran during fix: declare podman 4.9 the floor and refuse every subpath above it #117.