ci: Work around Compose's external Dockerfile permission error

[Christof Marti (chrmarti)]

Summary

• Add a shared composite action containing a behavioral probe and conditional source build/install. Each affected workflow gains only one setup-action invocation, with no extra jobs, artifact transfers, permissions, or test-branch triggers.
• Probe the installed Compose with an external Dockerfile containing only FROM scratch and a label. No image downloads or containers are needed. If it builds successfully, keep the installed Compose.
• Build the fixed Compose only when the probe fails with the specific --allow=fs.read error naming its Dockerfile. Other failures retain their exit status and fail setup explicitly.
• Build exact upstream commit 1e1c577eab08ceb5ff0fcf4d8e3cbbc08a34ef35 from fix(bake): grant permissions for configured build inputs docker/compose#14325, verify the checkout, and install it as 5.6.0-dev.1e1c577 to preserve CLI capability detection. Rerun the same probe after installation to verify the actual behavior.
• Clean up the temporary probe files and any successfully created probe image, including failure paths.
• No GitHub API/token dependency or guessed release threshold. Keep Buildx and filesystem entitlement enforcement unchanged. Backports and development builds are tested by behavior.

Related to #1320; addresses the CI failures observed on #1329 without including that PR's dependency update. This is a CI workaround, not a runtime fix for CLI users.

Validation

• npm run compile and npm run precommit passed.
• YAML validation and all embedded Bash syntax checks passed.
• 12 local probe/install/cleanup scenarios passed: already-working Compose, matching permission failure, unrelated errors, missing Compose, build/install failures, post-install verification, and cleanup failures.
• The minimal probe reproduced the bug locally on Compose 5.5.1 / Buildx 0.37.2 in 0.52 seconds.
• Probe-based CI passed: Linux PR matrix, Docker 29, and push CI. Logs confirm the probe reproduced the exact permission error, installed the source fix, rebuilt successfully, and removed the probe image. All PR checks are green.

Follow-up

Runners with working Compose skip the source build automatically. Remove this workaround once all affected runners ship fixed Compose.

[Copilot]

🟢 Approval recommended

No unresolved findings remain, and the reported CI validation confirms successful workflow integration.

No open issues 🎉

What changed in this PR

Adds a CI-only workaround for Compose’s external-Dockerfile permission bug without changing CLI runtime behavior or disabling filesystem checks.

Changes:

• Adds a behavioral probe that installs pinned Compose source only for the specific permission failure.
• Verifies the replacement and cleans up probe resources.
• Integrates the shared action into both affected workflows.

File	Description
.github/​workflows/​test-docker-v29.yml	Runs Compose setup after Docker 29 installation.
.github/​workflows/​dev-containers.yml	Runs Compose setup after Docker configuration.
.github/​actions/​setup-compose/​action.yml	Implements probing, conditional installation, verification, and cleanup.

_{Review effort: Balanced}