fix: sort mount volumes by specificity to prevent parent mounts hiding children

When git repo mounts and regular file mounts have overlapping target
paths, broader parent mounts hide deeper child mounts because Docker
Compose applies volumes in array order.

- Add sort_volumes_by_specificity() to docker.py:
  - Sorts by target path depth (parent paths first, child paths last)
  - Logs warnings for duplicate targets
  - Handles :bind and :ro suffixes correctly

- Integrate into manifest flow (compile_compose):
  - Sorts manifest mounts + EXTRA_VOLUMES before writing compose

- Integrate into legacy flow (_modify_compose_file):
  - Sorts after appending extra_volumes to existing template volumes

- Add 6 unit tests covering parent/child ordering, stable sort,
  type suffixes, empty list, single volume, and duplicate warnings.

Quality gates: pytest (214 passed, 6 pre-existing), tsc --noEmit (clean)

openspec/tasks/mount-specificity-ordering.md

@@ -0,0 +1,12 @@
+# Tasks: Mount Specificity Ordering
+
+- [x] Exploration written
+- [x] Proposal written
+- [x] Spec written
+- [x] Design written
+- [x] Implement `sort_volumes_by_specificity` in `docker.py`
+- [x] Integrate sorting into `compile_compose` (manifest flow)
+- [x] Integrate sorting into `_modify_compose_file` (legacy flow)
+- [x] Add unit tests for helper and overlap scenarios
+- [x] Run quality gates (pytest, tsc)
+- [x] Commit and merge