compose --pod: add an opt-in mode to preserve service-level port mappings

## Feature request

When podlet compose --pod processes Compose ports entries, it moves every published port to the generated .pod Quadlet.

For example:

name: port-repro

services:
web:
image: docker.io/library/nginx:alpine
ports:
- "8080:80"

server:
image: docker.io/library/alpine:latest
command: ["sh", "-c", "sleep infinity"]
ports:
- "3478:3478/udp"

Running:

podlet --file ./quadlets compose --pod compose.yml

produces a pod containing:

[Pod]
PublishPort=8080:80
PublishPort=3478:3478/udp

The generated container Quadlets contain no PublishPort= entries.

This is Podlet’s documented behavior and is appropriate for normal pods with a shared network namespace. It should remain the default. Podman also documents that ports normally must be published by the pod rather than individual containers in a pod.

However, in my NetBird Quadlet deployment, the generated pod-level port mappings do not work. The deployment works after post-processing the output so each mapping remains on the container corresponding to the Compose service that declared it:

# web.container
[Container]
PublishPort=8080:80

# server.container
[Container]
PublishPort=3478:3478/udp

## Requested behavior

Please add an explicit opt-in port-placement option, for example:

podlet compose --pod --port-placement=container compose.yml

or:

podlet compose --pod --preserve-service-ports compose.yml

When enabled, Podlet would:

- Keep each Compose port mapping associated with its originating service.
- Generate PublishPort= in that service’s .container file.
- Avoid adding those mappings to the .pod file.
- Support TCP, UDP, host-IP bindings, and both short and long Compose port syntax.
- Leave the existing pod-level behavior unchanged by default.

## Podman compatibility question

Podman documents container-level port publishing inside a shared-network pod as unsupported. If container-level publication cannot be made valid with Pod=, could Podlet provide or document a supported equivalent that preserves service-level port ownership?

At minimum, it would be helpful for Podlet to expose the port-placement decision explicitly instead of requiring downstream scripts to rewrite generated Quadlets.

Start at the podlet compose --pod command path and trace how Compose ports entries become generated .pod and service .container Quadlets. Compare the requested opt-in behavior across short and long syntax, TCP/UDP, and host-IP bindings; done means default pod-level output is unchanged and the option preserves mappings on originating services, with Podman compatibility documented or resolved.

Written by the indexing model from the issue text.