Warn when compose references a config var that won't be interpolated

Config variables referenced in a service command are not interpolated at deploy time (see DefangLabs/pulumi-defang#355 / #357 — inlining a resolved value into command would embed secrets as plaintext in the cloud resource definition, and command has no native secret-ref mechanism on ECS/ACA, so it can't be made safe uniformly across clouds).

Today a command: ["--model", "${MODEL}"] silently reaches the container as the literal ${MODEL}. The CLI is the right layer to warn about this (it sees the compose file before deploy), and it can do so without false positives — a ${VAR} in command is legitimate when the entrypoint is a shell (image ENTRYPOINT is sh -c/bash -c, or the compose entrypoint is a shell), because the shell expands it from the container's environment (which is resolved) at runtime.

Proposed check at compose validation/deploy time:

• Warn only when the effective entrypoint is not a shell, so the ${VAR} cannot be expanded at runtime.
• Message: point the user to move the variable into environment.

(A CD-side warning was rejected in DefangLabs/pulumi-defang#357 — wrong layer, and it can't cheaply tell whether the entrypoint is a shell.)

No files or tests are named; start by locating the compose validation or deploy entry point that inspects service command and entrypoint values. Trace effective entrypoint handling, then add coverage for shell and non-shell cases; done means warning only for non-shell commands and directing users to move the variable into environment.