feat(compose): extend CS_N custom services with image, env-file, and volume mounts

[acamarata]

Summary

Closes CLI gap G-013: nself build could not express a pinned image
digest, injected SMTP env vars, or an extra volume mount for a custom
service. The ntask production stack needed all three, so it was
hand-authored into docker-compose.override.yml — invisible to nself build and silently lost on any CLI-only rebuild.

Extends the existing CS_N custom-service model (no new mechanism) with
three new env vars, all declarable in .env:

• CS_N_IMAGE — run a pre-built image (optionally digest-pinned via
  @sha256:...) instead of building from a Dockerfile. Mutually
  exclusive with CS_N_PATH.
• CS_N_ENV_FILE — inject KEY=VALUE pairs from a dotenv-format file,
  applied after CS_N_ENV_PASSTHROUGH and before CS_N_ENV. Handles
  values CS_N_ENV's comma-joined format can't represent safely (e.g.
  a password containing a comma) and many-var cases like SMTP config.
• CS_N_VOLUMES — comma-separated host:container[:mode] bind mounts,
  appended to the generated service.

Example expressing the three ntask requirements:

CS_1=email-storage:go
CS_1_IMAGE=minio/minio:RELEASE.2024-01-16T16-07-38Z@sha256:<digest>
CS_1_VOLUMES=./email-templates:/app/templates:ro

CS_2=ntask-api:go:8010
CS_2_ENV_FILE=./secrets/smtp.env

Generator gains WithWorkDir to anchor CS_N_ENV_FILE reads to the
project root; the build orchestrator now threads st.workdir through
so it resolves correctly regardless of invocation directory.
buildCustomService/Generate() now return an error on a missing or
unreadable CS_N_ENV_FILE rather than silently starting the service
without the vars it needs.

coreEnvVars was refactored into smaller named steps
(fixedCoreEnvVars/addOptionalStoreEnvVars/applyEnvPassthrough/
applyExtraEnv) while adding this — it was already over the repo's
50-line function cap before this change.

Docs: .github/wiki/Config-Custom-Services.md reference table + notes
updated (this also fixes a pre-existing doc/code drift: the page
already forward-referenced CS_N_IMAGE as "advanced usage" before it
existed in code).

Test plan

• go build ./... clean
• gofmt -l . clean, make vet clean, golangci-lint run clean
• go test ./... — 5139 tests pass across 98 packages (no regressions)
• New unit tests: parse-time validation (config package — image/path
  mutual exclusion, path traversal, volume entry shape) and
  compose-time behavior (image skips build, volumes appended,
  env-file precedence order, missing env-file fails loudly)
• internal/compose coverage 90.1%, internal/config coverage 80.5%
  (both above the 70% gate)
• make cmd-inventory re-run: no diff (no new commands added, as
  expected for an env-var-only extension)