[rmcdaniel]

Security found that run-composer.sh appended its checked CA mount after caller options but still admitted Docker options capable of shadowing or inheriting that mount. This focused correction is stacked directly on #673's exact 5669e2e4 head for owner integration; it does not change Rust/native/shared product source or replace #698.

Changes:

• refuse any Docker option/value naming /checked-ca before Docker starts;
• refuse both separated and = forms of --volumes-from;
• cover volume, mount, tmpfs, device, inherited-volume, CA-variable, env-file and entrypoint counterfactuals;
• retain an explicit allow-path test for unrelated Docker options;
• resolve the two open Sonar clarity findings with an explicit default case and named function argument.

Local evidence:

• 14 mount-independent Composer inventory, adversarial refusal, pinned trust-store and Brotli-floor controls pass;
• Bash/POSIX-shell syntax and git diff --check pass;
• the full 16-test invocation produced those 14 passes plus two runner-blocked bind-mount cases because the external Docker daemon could not see the local temporary paths. Both failed before exercising changed product logic and remain recorded rather than called passes.

Hosted run 39985098961 supplies the missing real bind-mounted paths on the exact commit. Central policy, Repository contracts, the complete Composer/Cargo trust controls, the fixed-Brotli image control, the PHP feature suite and final Feature source qualification all pass. Both public-boundary scans pass; the prepared-local candidate job is intentionally skipped for this draft.

The owner should integrate this additively with #698, bring the combined head current, and use normal hosted qualification. This draft is not merge, release or publication acceptance.