fix: bug: generator emits ghcr.io/disinto/agents image ref but no registry pull is configured (#853)

The TOML-driven hired-agent services (`_generate_local_model_services` in
`lib/generators.sh`) were emitting `image: ghcr.io/disinto/agents:<tag>`
for every hired agent. The ghcr image is not publicly pullable and
deployments don't carry ghcr credentials, so `docker compose up` failed
with `denied` on every new hire. The legacy `agents-llama` stanza dodged
this because it uses the registry-less local name plus a `build:` fallback.

Fix: match the legacy stanza — emit `build: { context: ., dockerfile:
docker/agents/Dockerfile }` paired with `image: disinto/agents:<tag>`.
Hosts that built locally with `disinto init --build` will find the image;
hosts without one will build it. No ghcr auth required either way.

Added a regression test that guards both the absence of the ghcr prefix
and the presence of the build directive.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/generators.sh

@@ -114,7 +114,15 @@ _generate_local_model_services() {
             cat >> "$temp_file" <<EOF
 
   agents-${service_name}:
-    image: ghcr.io/disinto/agents:\${DISINTO_IMAGE_TAG:-latest}
+    # Local image ref (#853): registry-less name matches what \`disinto init --build\`
+    # and the legacy agents-llama stanza produce. Paired with build: so hosts without
+    # a pre-built image can rebuild locally; ghcr.io/disinto/agents is not publicly
+    # pullable, and emitting that prefix caused \`docker compose up\` to fail with
+    # \`denied\` on every hired agent.
+    build:
+      context: .
+      dockerfile: docker/agents/Dockerfile
+    image: disinto/agents:\${DISINTO_IMAGE_TAG:-latest}
     container_name: disinto-agents-${service_name}
     restart: unless-stopped
     security_opt: