run the golden suite against the CLI too, and pin every delta

Both engines now go through the same 68 cases. 31 produce byte-identical
output; the rest have a recorded CLI expectation and a reason in DELTAS.md,
the bulk of it being that the CLI does not shell out to a recursive make and
calls compose once per project.

Fixed while comparing: the CLI was missing the COMPOSE_FILE_* defaults, so
overlays such as supabase.labels.yml would not have been loaded at all.

lib/cmd/doctor.sh

@@ -1,4 +1,5 @@
 #shellcheck shell=sh
+# shellcheck disable=SC3028  # HOSTNAME is a myos variable, set by bin/myos
 # myos doctor  check that this installation can actually run a stack
 myos_cmd_doctor() {
   _rc=0
@@ -21,7 +22,6 @@ myos_cmd_doctor() {
   [ -f "$WORKDIR/.env" ] && _ok "$WORKDIR/.env" "read"
   _ok ENV "$ENV"
   _ok USER "$USER"
-  # shellcheck disable=SC3028  # HOSTNAME is set by bin/myos
   _ok HOSTNAME "$HOSTNAME"
   _ok DOMAIN "$DOMAIN"
   _ok "project format" "${MYOS_PROJECT_FORMAT:-user-env-app}"