fix: make challenge toggle actually work end-to-end (5 root-cause bugs)

Found by testing a real enable/disable cycle (art, fjb, gift-card):

1. compose_gen always swapped build->image, so a never-built challenge
   produced 'pull access denied for services-<name>'. Now it only reuses
   the image when it exists locally, otherwise keeps build: so
   'docker compose up --build' builds it.
2. Canonical templates use 'build: context: .' (written for the shared
   services/ tree). In the per-team compose that resolves to the team dir
   which has no Dockerfile -> 'failed to read dockerfile'. The renderer
   now rewrites the main service's context to ./<name>.
3. Teams created before the XVI/XVII import had no xvi/xvii subpackages
   under their local challenges/ dir, so the regenerated receiver main.py
   crash-looped on import. gen_receiver_main now mirrors ALL shared
   checkers (native + xvi + xvii) into every team receiver on each sync.
4. systemd Environment= keys can't contain hyphens, so
   CHALLENGE_PORT_GIFT-CARD was silently dropped. Keys are now
   normalized to underscores on both the writer and reader side.
5. Several checkers called 'docker exec' with no timeout; against a
   container with accumulated chall.py zombies that blocks forever and
   stalls the whole SLA loop. Added mandatory timeouts (Phew, Sheesh,
   Carbeat, Poke, Warmup).

Also: enabling a challenge now copies its source tree into each team's
services/ dir (team dirs only held challenges enabled at create_team
time), and the XVII checkers were rewritten to be protocol-aware
(gift-card/gift-voucher are socat TCP, not HTTP) with strict timeouts.

panel/compose_gen.py

@@ -18,6 +18,7 @@ anti-alchemy, tempest-poc) keep their sidecar services.
 """
 import json
 import re
+import subprocess
 from pathlib import Path
 
 BASE = Path("/opt/gemastik18-final")
@@ -47,6 +48,18 @@ def read_template(name: str) -> str:
         raise FileNotFoundError(f"Tidak ada template compose untuk {name} di {p}")
     return p.read_text()
 
+def _image_exists(image_name: str) -> bool:
+    """True if the docker image is already present locally.
+
+    The renderer only swaps a service's `build:` block for `image: services-<name>`
+    when that image actually exists. Otherwise compose would try to PULL a local
+    build artifact and fail with "pull access denied for services-<name>".
+    """
+    r = subprocess.run(["docker", "image", "inspect", image_name],
+                       capture_output=True, text=True, timeout=30)
+    return r.returncode == 0
+
+
 def _parse_services(text: str):
     names = []
     for line in text.splitlines():
@@ -93,10 +106,12 @@ def render_team_compose(idx: int, state: dict) -> str:
         text = re.sub(rf'"({org}):', f'"{tc}:', text)
         text = re.sub(rf'"({org + 22}):', f'"{ts}:', text)
 
-        # --- build: -> image for MAIN only ---
-        # Replace the main service's build block with image: services-<name>.
-        # NB we process by service names, not generic removal, so sidecar
-        # builds survive.
+        # --- build: -> image for MAIN only (only when the image exists) ---
+        # Replace the main service's build block with image: services-<name> so
+        # teams share one image. If that image was never built, KEEP the build
+        # block so `docker compose up --build` builds it instead of trying to
+        # pull a nonexistent local image.
+        use_image = _image_exists(f"services-{name}")
         lines = text.splitlines()
         i = 0
         in_main = False
@@ -112,7 +127,7 @@ def render_team_compose(idx: int, state: dict) -> str:
                 i += 1
                 continue
             # inside a service block
-            if in_main and line.strip() == "build:":
+            if in_main and use_image and line.strip() == "build:":
                 # skip build block (context/args/dockerfile...) until next key at same indent
                 out.append(f"    image: services-{name}")
                 i += 1
@@ -127,6 +142,15 @@ def render_team_compose(idx: int, state: dict) -> str:
         text = re.sub(r"\$PASSWORD_" + str(org) + r"\b", passwords[name], text)
         text = re.sub(r"PASSWORD_" + str(org) + r"\b", passwords[name], text)
 
+        # --- build context -> per-team challenge subdir ---
+        # Canonical templates are written for the SHARED services/ tree where a
+        # challenge's files sit in services/<name>/. The per-team compose lives in
+        # teamN/services/, so a bare `context: .` would resolve to the team dir
+        # (no Dockerfile). Point the MAIN service's build at ./<name>.
+        if re.search(r"^    build:$", text, re.M):
+            text = re.sub(r"^    build:\n      context: \.$",
+                          f"    build:\n      context: ./{name}", text, count=1, flags=re.M)
+
         # --- flag volume normalization ---
         # Replace any ./flag.txt / ../receiver/flags/<name>.txt with the per-team flag mount
         text = re.sub(r"\./flag\.txt(:\w+)?", f"../receiver/flags/{name}.txt", text)