feat(xtask): cargo xtask compliance capabilities — manifest enforcement in CI

Source: adr-005-graceful-degradation-verification plan Potential Improvements.

Add cargo xtask compliance capabilities that re-parses docker-compose.yml and asserts every program service declares the profile set listed in compliance/deployment-profile-capabilities.toml. Prevents silent drift when a new profile or service lands but the manifest is not updated.

Acceptance: new xtask subcommand fails CI when a service in compose lacks a manifest entry, or when a manifest entry references a non-existent service; runs as part of cargo xtask validate.