feat: inspect-image reads what a game's image needs

`gbrgames inspect-image -game <id>` pulls the image and reads, without
starting the game (probe runs with --network none and bypasses the
entrypoint): its user, accounts, home folder owners and modes, tools
(java, steamcmd, proton...), startup scripts and the variables they read.

It then checks the template against those facts:
- an image built around its own user (a locked home owned by another uid,
  or a declared USER) needs a matching containerUser
- the startup command must read settings under the names the node gives
  them (the agent's toUpperSnakeCase), and must not read unset variables
  that have no default

On the template from the first commit it reports both ARK bugs found by
boot tests today (uid 25000; ${RCON_PORT} vs RCONPORT); the current five
templates pass. Boot tests now run it first, so such templates fail in
seconds instead of after a boot. -json prints the facts for tooling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -67,6 +67,12 @@ go run ./cmd/gbrgames validate                     # what CI runs on every push
 go run ./cmd/gbrgames import admin-games.export.json  # pull templates from GET /api/v1/admin/games
 ```
 
+`go run ./cmd/gbrgames inspect-image -game <id>` pulls the game's Docker image and reads what it needs
+without starting the game: its user, home folder permissions, ports, tools and startup scripts. It then
+checks the template against that, e.g. an image built around its own user needs `containerUser`, and a
+startup command must read settings under the names the node gives them (`RCONPort` arrives as
+`RCONPORT`). Boot tests run it first, so these fail in seconds. `-json` prints the facts for tooling.
+
 Besides the schemas, `validate` checks that each folder name matches its `id`, that referenced config
 keys exist, that consents don't default to accepted, and that no credentials or private network
 addresses end up in a template.