buildMountOptions warns "should not define bind option" for named volumes carrying only an SELinux relabel flag, which compose itself consumes #14435

Description

A named-volume mount written with the documented short syntax vol:/path:z
canonicalises to type: volume + bind: {selinux: z}; bind.selinux is the
compose model's only slot for a relabel flag (volume: {selinux: z} is a schema
error, so there is no long-syntax alternative). buildMountOptions() then warns
unconditionally on volume.Type != VolumeTypeBind && volume.Bind != nil,
so every such mount emits a warning on every container create.

The warning is a false positive here, because compose itself consumes the
option it is warning about: two functions later buildContainerVolumes()
routes plain named-volume mounts through the legacy HostConfig.Binds string
API via toBindString(), which appends v.Bind.SELinux (the modern Mounts
API cannot express relabels). Support for bind.selinux on named volumes was
added deliberately in compose-spec/compose-go#213 (fixing #9072, where the
flags were silently dropped). So the configuration is correct, compose honours
it, and the user is told it is wrong.

Steps to reproduce

services:
  probe:
    image: busybox:latest
    command: ["true"]
    volumes:
      - probevol:/data:z,rw
volumes:
  probevol:

docker compose up prints, once per z/Z-flagged named-volume mount per create:

time="..." level=warning msg="mount of type `volume` should not define `bind` option"

docker inspect confirms the flag was honoured:
Binds: ["proj_probevol:/data:rw,z"].

Expected

No warning when the bind: struct on a type: volume mount sets only
selinux, since that field is both the sole supported spelling and one compose
acts on. A bind: struct setting other fields (propagation,
create_host_path) on a volume mount should keep warning.

Impact

On SELinux-enforcing hosts the flags are load-bearing, so the warning cannot be
avoided by dropping them, and --log-level error suppresses all warnings rather
than this one. Deployment tooling ends up filtering the line out of compose's
stderr. It also breaks machine-readable output for downstream consumers:
ansible-collections/community.docker#846 is the same line failing an event
parser.

Versions

Reproduced on Compose v5.1.3 / Engine 29.4.1 (2026-07-19) and Compose v5.5.0 /
Engine 29.7.2 (2026-09-06). buildMountOptions() on main is unchanged.