[jooh]

The Rust CLI lacked the new upstream --docker-arg option and misparsed image references containing both a tag and digest. Advance the upstream CLI pin from v0.89.0 to a190a3f86fe20b582c25c4dcb7bbf5fdb739ab26 (v0.90.0 plus the subsequent argument-forwarding changes).

• Preserve repeated literal Docker arguments across runtime commands, probes, exec, and the Compose plugin; exclude standalone Compose executables and child-command arguments.
• Resolve tag@digest references by digest while retaining tag metadata and handling registry ports.
• Replace deprecated serde_yaml and its unmaintained unsafe-libyaml dependency with Saphyr, preserving Compose tags and collection inspection.
• Refresh compatibility inventories and CLI metadata, map the new upstream tests, verify relative symlink startup, and reuse upstream's scoped Compose CI workaround.

Validation:

• 1,070 Rust tests and all 3 live GHCR tests passed locally.
• 24 relevant upstream TypeScript regression tests passed.
• Formatting, Clippy, type checking, rustdoc, coverage, cargo-deny, actionlint, ShellCheck, release builds, wheel installation, package smoke tests, and compatibility checks passed.
• make -k tests fails only at the Docker-dependent devcontainer provisioning smoke test because the local host cannot run container namespaces. Real Docker/Podman lifecycle validation is delegated to this PR's CI.

CI: all 9 checks passed, including Docker and Podman lifecycle smoke tests, Linux/macOS package builds, and isolated archive/wheel smoke tests.

Pinned spec remains c95ffeed1d059abfe9ffbe79762dc2fa4e7c2421. Existing command-depth parity limitations remain documented in the compatibility dashboard.