Add pull-always support and reject unknown CLI arguments

[jooh]

Summary

• add the native devcontainer up --pull-always option; refresh plain-image sources, remote Dockerfile bases, and the effective Compose run/dependency image closure without attempting to pull locally generated Feature or UID-update tags
• resolve Compose configuration and profiles through the selected provider, then perform checked, deduplicated engine pulls (including service platforms) so Docker, Podman, Docker Compose, and standalone podman-compose propagate pull failures consistently
• reject unknown CLI options and excess positionals before dispatch, with an actionable migration from --pull=always, while preserving declared positionals, inline values, variadic options, -- semantics, and exec payload passthrough
• expose supported native-only command options in generated help metadata, keep parity inventory current, and fix the template omission Clippy lint
• make the Podman Actions job fail promptly when an Ubuntu mirror is unhealthy by bounding APT retries/timeouts and excluding the stale Azure mirror entry

Verification

• make tests
• real-engine Docker and Podman lifecycle jobs exercise up --pull-always for both single-container and Compose configurations

The pinned upstream and spec submodule revisions are unchanged.