Give keys.py's cross-module primitives a real interface

[lesnik512]

Summary

• Drops the leading underscore on six compose2pod/keys.py names — _Expand, _is_number, _validate_map, _extra_host_pairs, _key_value_pairs, _pairs_to_mapping — that five other production modules (pod.py, resources.py, emit.py, stores.py's neighbor extends.py) and four test files already import directly. The underscore no longer reflected reality; this makes the real interface honest.
• Pure rename: no signature, logic, or behavior changes. Token = str | Expand (already public) is unchanged.
• Adds Token/Expand entries to architecture/glossary.md now that they're openly shared vocabulary.
• Candidate Port the compose-to-podman-pod converter into compose2pod #1 from the 2026-07-13 architecture review (companion to Derive extends' merge policy from KeySpec #47/Adopt planning-convention v1.1.2 and migrate planning docs #2, which already shipped).

Full rationale: planning/changes/2026-07-13.07-public-keys-primitives.md.

Test plan

• just test-ci — 405 passed, 100% line coverage (identical count to baseline — a rename adds no tests)
• just lint-ci — clean
• Task-scoped subagent review — approved, no findings
• Final whole-branch subagent review — ready to merge, no findings