composelint

Docker Compose security linter — OWASP/CIS-grounded rules, SARIF, dry-run auto-fix