read the exposure scope from the compose file, drop the _EXPOSE variable

The variable declared an intent and changed nothing: it fed the report and
never the binding, so it could say public while the file published on the
loopback, or the reverse. A declaration that cannot be wrong is better than one
that has to be kept in step.

The scope is now which binding the file asks for, read from the compose files
as written: ${MYOS_BIND_PUBLIC} is public, a hand-written address is pinned,
and a bare '- 80' or '9000:9000' is unbound, meaning docker opens it on every
address and nobody chose that. --strict fails on those.

Reading the resolved configuration instead would lose the distinction: every
form ends up as a plain address, and an unbound port looks exactly like a
deliberate public one.

What is left to configure per host is the address of each scope, which is the
part that belongs to the host rather than to the stack.

CHANGELOG.md

@@ -24,7 +24,8 @@
   fails when a port faces the world without saying so. `MYOS_BIND_PUBLIC`,
   `_PRIVATE` and `_MESH` let a stack bind its published ports, which replaces
   the linux-only ufw-docker patching with something that behaves the same on
-  macOS and needs no privilege
+  macOS and needs no privilege. The scope is read from the compose file rather
+  than declared beside it, so it cannot disagree with what is published
 - commands chain: `myos build up logs host/fabio`, as make targets did
 - the stack catalogue no longer needs make at all: its settings are hooks, and
   only six stacks keep a .mk, for targets