run the golden suite against the CLI too, and pin every delta

Both engines now go through the same 68 cases. 31 produce byte-identical
output; the rest have a recorded CLI expectation and a reason in DELTAS.md,
the bulk of it being that the CLI does not shell out to a recursive make and
calls compose once per project.

Fixed while comparing: the CLI was missing the COMPOSE_FILE_* defaults, so
overlays such as supabase.labels.yml would not have been loaded at all.

spec/golden/record.sh

@@ -3,6 +3,7 @@
 # Usage: spec/golden/record.sh [case-name ...]
 set -u
 here=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=spec/support/run.sh
 . "$here/../support/run.sh"
 MYOS_ROOT=${MYOS_ROOT:-$(cd "$here/../.." && pwd)}
 only="$*"