0.7: Refactor and land Inspect Compose/container support #311

Parent: #289. Inspect source: #291.

Work boundary 13/13 from the approved 0.7 → clients → Inspect sequence.

Dependencies: #305, #310.

Preserve proposed Compose/container features from #291 while adapting to native image/session contracts. Reuse SDK/service implementations rather than duplicating runtime logic.

Acceptance criteria:

• Supported Compose/container scenarios and unsupported combinations have precise acceptance.
• Build/transfer limits, regular-file checks, ownership and evaluator grants hold.
• End-to-end Inspect acceptance runs unconditionally in the gate; no leaked sessions.

Planned PR boundaries: Compose/container adaptation and complete Inspect package qualification.

Implementation progress and evidence: Sprinty in the isolated integration/0.7-clients-inspect worktree. Focused tests during development; fast checks/Citadel per PR; relevant black-box proof for runtime, credential or image boundaries. Respect the active release and machine locks.