test(deploy): validate production Compose renders

[SmithLabsLLC]

Summary

• add a secret-free production Compose render test
• validate the base, Caddy/TLS, development, and combined TLS-development
  configurations
• run the test and ShellCheck in a dedicated path-filtered CI workflow

Why

The production Compose bundle previously had only a manual validation
checklist. Override or interpolation errors could therefore merge without any
automated render coverage.

The test copies only checked-in Compose files and .env.example placeholders
to a disposable directory. It runs docker compose config --quiet and does not
start containers or create volumes or networks.

Testing

• shellcheck deploy/compose/run.sh deploy/compose/test.sh
• bash -n deploy/compose/run.sh deploy/compose/test.sh
• deploy/compose/test.sh
• YAML parse of .github/workflows/compose.yml
• git diff --check

All four Compose combinations rendered successfully.

Review

One Fable 5 xhigh review initially returned NEEDS CHANGES. All accepted
findings were incorporated: the draft covers the combined TLS-development
merge, triggers on prometheus.yml, and cancels superseded pull-request runs.
The executable mode is preserved. No second independent review was run.

Scope

This adds a CI signal. It does not change branch-protection settings, start a
deployment, read a real .env, or change runtime behavior.