docs: compact the supported-subset page

[lesnik512]

Stacked on #53 (it rewrites the same file). Design: planning/changes/2026-07-14.01-compact-supported-subset.md. Spawned by the audit in #52.

architecture/supported-subset.md is the accept/ignore/reject truth for the whole tool, and it is the page you read to answer "is this key supported, and what does it do?". It had reached 765 lines, much of it duplication and prose restating what a table row says.

765 → 592 lines, with no rule lost.

What changed

• Secrets + Configs → one Stores section (126 → 63 lines). The old page admitted they were twins in its own words — "mirroring secrets", "byte-for-byte the same teardown parity as secrets". They differ in exactly four ways (store-name prefix, allowed sources, default mount target, whether an absolute target is required), which is now a four-row table. The shared rules — closure-scoped creation, mounting, teardown, interpolation — are stated once.
• Service keys tabulated (174 → 132 lines). The ~30 bullets of the form "X is a list, emitted as repeated --x" became two tables (registry keys, resource keys). Prose survives only where a table genuinely can't carry the behavior: entrypoint's shell-vs-exec semantics, hostname/container_name resolving via the pod-wide --add-host set, and why each ignored key is inert.
• Code citations cut from roughly one per bullet to one per section. They're useful navigation, but they're also the page's drift surface — the audit found it citing _MAP_FLAGS, a symbol that no longer exists.

The headline is not the line count

8 gate rules that the old page never documented are now on it, found by working from the code rather than from the page: the store-name and env-var-name regexes, the uid/gid/mode shape checks, the top-level volumes warning, startup_order's three closure-time raises, and deploy.resources' unrecognized-key rejection. Two more added in review: the healthcheck interval 1-second floor (so "500ms" is accepted but polls once a second — the script's polling loop has no sub-second resolution) and the store-reference list shape.

So the reformat saved more than the 173-line delta suggests; part of the budget went to content that should always have been there.

How "no rule lost" was verified

Not by reading the old page against the new one — that's exactly the process that let it drift. The review AST-walked compose2pod/*.py for all 102 raise UnsupportedComposeError sites, resolved each to its message, enumerated the 5 warnings.append sites and the accepted-shape sources (SERVICE_KEYS, STRUCTURAL_KEYS, PULL_POLICY_MAP, StoreKind, the sweep chain), and confirmed each rule still appears on the page. It also reproduced every non-obvious table cell against the real code to check for overclaims, and found none.

Doc-only: no code, no tests, no behavior. 549 tests still green at 100%.

🤖 Generated with Claude Code