fix(publish): detect named volumes with driver_opts bind in checkForBindMount

[ishwar170695]

Problem
checkForBindMount only flags VolumeTypeBind entries directly in service.volumes. A named volume (VolumeTypeVolume) whose top-level definition uses driver: local with driver_opts (o: bind, device: /host/path) bypasses the check entirely, the host path leaks into the OCI artifact metadata without any user warning.
Reproducer: compose.yaml

services:
  web:
    image: nginx
    volumes:
      - secret_host_data:/mnt/data
volumes:
  secret_host_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: /Users/admin/.ssh

Before this fix: compose publish proceeds with no prompt.
After this fix: user is warned and must confirm.

Fix
Extended checkForBindMount to also walk project.Volumes for named volume references and detect driver_opts bind mounts via a new isDriverOptsBind helper. The helper splits the o field on commas to avoid false positives like nobind.
Tests
Added Test_checkForBindMount_namedVolume_driverOptsBind and a table-driven Test_isDriverOptsBind covering plain bind, rbind, comma-separated options, nobind false positive, missing device key, and non-local driver.

(not mandatory) A picture of a cute animal, if possible in relation to what you did

[Copilot]

Pull request overview

Extends publish pre-checks to warn users when a named volume is actually a bind mount via driver_opts (e.g., local driver with o=bind and device=/host/path), preventing accidental host-path leakage into OCI artifact metadata.

Changes:

• Updated checkForBindMount to detect bind mounts declared through top-level named volume driver_opts.
• Added isDriverOptsBind helper to identify bind/rbind options safely (avoiding substring false-positives like nobind).
• Added unit tests for named-volume bind detection and table-driven coverage for isDriverOptsBind.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
pkg/compose/publish.go	Detects driver_opts-based bind mounts for named volumes and surfaces them in the publish prompt.
pkg/compose/publish_test.go	Adds tests covering named-volume bind detection and option parsing edge cases.
h --force-with-lease	Appears to be an accidentally committed scratch/artifact file (should not be in the repo).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.