Fix Compose tmpfs options and validate stack configuration

compose.yml

@@ -4,7 +4,7 @@ x-app: &app
   read_only: true
   cap_drop: [ALL]
   security_opt: [no-new-privileges:true]
-  tmpfs: [/tmp:rw,noexec,nosuid,size=64m]
+  tmpfs: ['/tmp:rw,noexec,nosuid,size=64m']
   mem_limit: 512m
   pids_limit: 128
   volumes: [config:/config]

scripts/compose_stack.sh

@@ -11,6 +11,7 @@ if [[ "$mode" == ci ]]; then
     export POSTGRES_PASSWORD
     POSTGRES_PASSWORD=$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))')
     unset CONFIG_VOLUME CONFIG_EXTERNAL
+    docker compose -f compose.yml --profile ci config --quiet
     # Only this unique disposable CI project is removed, including its volumes.
     trap 'docker compose -f compose.yml --profile ci down --volumes --remove-orphans >/dev/null' EXIT
     docker compose -f compose.yml --profile ci run --rm integration
@@ -53,6 +54,7 @@ fi
 # Capture a persistent random password in memory; never echo it or use shell tracing.
 export POSTGRES_PASSWORD
 POSTGRES_PASSWORD=$(docker run --rm --volume "$CONFIG_VOLUME:/config" --entrypoint python "$DEPLOY_IMAGE" -c 'from pathlib import Path; from adcloud_server.container_entrypoint import bootstrap; print(bootstrap(Path("/config/identity.env"))["POSTGRES_PASSWORD"])')
+docker compose -f compose.yml config --quiet
 # Initialize databases before switching the public API port.
 docker compose -f compose.yml up -d postgres cassandra
 docker compose -f compose.yml run --rm cassandra-init