Gate-zero import check runs:
docker compose -p $SH_COMPOSE_PROJECT -f compose.yaml run --rm app ...
When SH_COMPOSE_PROJECT is unset/empty, -p consumes -f as project name
(invalid). Adding 'name: tonemark' to compose.yaml declares the project
name in the file itself — the compose file is self-sufficient.
All 14 tests pass, build + typecheck clean.