Build the Apple Container extension

Turns the empty scaffold into a working Nova extension for Apple Container
and container-compose, in the shape of the Docker Suite extension.

Sidebar (Scripts/Sidebar):
- System, Containers, Images, Volumes and Networks sections
- Containers grouped into compose projects via the com.docker.compose.project
  label container-compose stamps; project rows drive compose up/down/build
  against the matching workspace file
- Lifecycle, shell, logs, inspect, browse and copy commands per resource
- Apple Container publishes no event stream, so the sidebar polls while
  visible and only reloads a section when a fingerprint of its data changes,
  which keeps selection and expansion intact

Hostnames (Scripts/Hostnames.js):
- A container's hostname is <name>.<domain> and the domain lives in Apple
  Container's config.toml, which has no CLI setter, so the Hostname Domain
  preference reads and writes that file directly
- Changing it offers to register the domain with macOS and restart the
  services; the write preserves the file's other tables and its mode

Language support:
- Dockerfile and Compose syntaxes backed by tree-sitter grammars built by
  Tools/build-syntaxes.sh, pinned to revisions that generate ABI 14
- The Compose syntax is named dockercompose because that is the languageId
  docker-language-server recognises compose files by
- docker-language-server is downloaded on first use rather than bundled, at
  roughly 40 MB

Icons are generated by Tools/make-icons.py so they can be regenerated rather
than hand-maintained.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01UnSBcR5Lywz5Fbj5FmVbfc

Queries/compose/highlights.scm

@@ -0,0 +1,70 @@
+; Compose files are YAML, with the sections and service names picked out.
+
+(comment) @comment
+
+; Top-level sections: services, volumes, networks, name, include, …
+
+(document
+	(block_node
+		(block_mapping
+			(block_mapping_pair
+				key: (flow_node) @keyword))))
+
+; Service, volume, network and secret names
+
+((block_mapping_pair
+	key: (flow_node) @_section
+	value: (block_node
+		(block_mapping
+			(block_mapping_pair
+				key: (flow_node) @identifier.type))))
+	(#match? @_section "^(services|volumes|networks|configs|secrets)$"))
+
+; Everything else that is a key
+
+(block_mapping_pair
+	key: (_) @identifier.key)
+
+(flow_pair
+	key: (_) @identifier.key)
+
+; Scalars
+
+((string_scalar) @string
+	(#not-match? @string "(?i)^(yes|no|true|false|on|off)$"))
+
+((string_scalar) @value.boolean
+	(#match? @value.boolean "(?i)^(yes|no|true|false|on|off)$"))
+
+(double_quote_scalar) @string
+(single_quote_scalar) @string
+(boolean_scalar) @value.boolean
+(integer_scalar) @value.number
+(float_scalar) @value.number
+(null_scalar) @value.null
+(block_scalar) @string
+
+(anchor_name) @identifier.constant
+(alias_name) @identifier.constant
+(tag) @identifier.type
+(escape_sequence) @string.escape
+
+[
+	"---"
+	"..."
+	"-"
+	"?"
+	":"
+	"|"
+	">"
+	"*"
+	"&"
+	","
+] @operator
+
+[
+	"["
+	"]"
+	"{"
+	"}"
+] @bracket