run the golden suite against the CLI too, and pin every delta

Both engines now go through the same 68 cases. 31 produce byte-identical
output; the rest have a recorded CLI expectation and a reason in DELTAS.md,
the bulk of it being that the CLI does not shell out to a recursive make and
calls compose once per project.

Fixed while comparing: the CLI was missing the COMPOSE_FILE_* defaults, so
overlays such as supabase.labels.yml would not have been loaded at all.

spec/support/run.sh

@@ -63,7 +63,10 @@ myos_run_engine() {
         make -esC "$MYOS_ROOT" MYOS=. WORKDIR="$_sb/wd" "$@" 2>&1); _rc=$?
       ;;
     cli)
+      # MYOS_PROJECT_FORMAT pins the legacy naming so that the goldens compare
+      # resolution, not naming; the new default is covered by the unit tests.
       _out=$(cd "$_sb/wd" && env -i $(myos_hermetic_env "$_sb") MYOS_CONF=/dev/null \
+        MYOS_PROJECT_FORMAT=user-app-env \
         "$MYOS_ROOT/bin/myos" -C "$_sb/wd" "$@" 2>&1); _rc=$?
       ;;
     *) echo "unknown engine $_engine" >&2; return 2 ;;