feat: inspect-image reads what a game's image needs

`gbrgames inspect-image -game <id>` pulls the image and reads, without
starting the game (probe runs with --network none and bypasses the
entrypoint): its user, accounts, home folder owners and modes, tools
(java, steamcmd, proton...), startup scripts and the variables they read.

It then checks the template against those facts:
- an image built around its own user (a locked home owned by another uid,
  or a declared USER) needs a matching containerUser
- the startup command must read settings under the names the node gives
  them (the agent's toUpperSnakeCase), and must not read unset variables
  that have no default

On the template from the first commit it reports both ARK bugs found by
boot tests today (uid 25000; ${RCON_PORT} vs RCONPORT); the current five
templates pass. Boot tests now run it first, so such templates fail in
seconds instead of after a boot. -json prints the facts for tooling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/boot-test.sh

@@ -23,6 +23,13 @@ go build -o "$gbrgames" ./cmd/gbrgames || exit 1
 passed=() failed=() skipped=()
 for id in "$@"; do
   echo "::group::boot test: $id"
+  # Seconds instead of a full boot: catches templates that can't work with their image (wrong
+  # container user, startup command reading a variable under the wrong name)
+  if ! "$gbrgames" inspect-image -game "$id"; then
+    failed+=("$id")
+    echo "::endgroup::"
+    continue
+  fi
   payload=$("$gbrgames" boottest-payload "$id")
   code=$?
   if [ $code -eq 3 ]; then