run the golden suite against the CLI too, and pin every delta

Both engines now go through the same 68 cases. 31 produce byte-identical
output; the rest have a recorded CLI expectation and a reason in DELTAS.md,
the bulk of it being that the CLI does not shell out to a recursive make and
calls compose once per project.

Fixed while comparing: the CLI was missing the COMPOSE_FILE_* defaults, so
overlays such as supabase.labels.yml would not have been loaded at all.

spec/golden/expected.cli/host-print-app.txt

@@ -0,0 +1,2 @@
+APP consul
+[exit 0]