fix: make challenge toggle actually work end-to-end (5 root-cause bugs)

Found by testing a real enable/disable cycle (art, fjb, gift-card):

1. compose_gen always swapped build->image, so a never-built challenge
   produced 'pull access denied for services-<name>'. Now it only reuses
   the image when it exists locally, otherwise keeps build: so
   'docker compose up --build' builds it.
2. Canonical templates use 'build: context: .' (written for the shared
   services/ tree). In the per-team compose that resolves to the team dir
   which has no Dockerfile -> 'failed to read dockerfile'. The renderer
   now rewrites the main service's context to ./<name>.
3. Teams created before the XVI/XVII import had no xvi/xvii subpackages
   under their local challenges/ dir, so the regenerated receiver main.py
   crash-looped on import. gen_receiver_main now mirrors ALL shared
   checkers (native + xvi + xvii) into every team receiver on each sync.
4. systemd Environment= keys can't contain hyphens, so
   CHALLENGE_PORT_GIFT-CARD was silently dropped. Keys are now
   normalized to underscores on both the writer and reader side.
5. Several checkers called 'docker exec' with no timeout; against a
   container with accumulated chall.py zombies that blocks forever and
   stalls the whole SLA loop. Added mandatory timeouts (Phew, Sheesh,
   Carbeat, Poke, Warmup).

Also: enabling a challenge now copies its source tree into each team's
services/ dir (team dirs only held challenges enabled at create_team
time), and the XVII checkers were rewritten to be protocol-aware
(gift-card/gift-voucher are socat TCP, not HTTP) with strict timeouts.

panel/gen_receiver_services.py

@@ -19,12 +19,16 @@ def write_unit(idx: int, st: dict):
     port = st["ports"]["receiver"]
     recv_dir = TEAMS_DIR / f"team{idx}" / "receiver"
     env = {}
-    # ports/containers for challenge classes
+    # ports/containers for challenge classes.
+    # NOTE: systemd Environment= keys must be [A-Za-z0-9_]+ — a hyphen in the
+    # challenge name (gift-card) would make systemd silently drop the line, so
+    # normalize the name to underscores here. main.py looks up the same key.
     for ch in st["ports"]:
         if ch in ("receiver", "panel"):
             continue
-        env[f"CHALLENGE_PORT_{ch.upper()}"] = str(st["ports"][ch]["chall"])
-        env[f"CHALLENGE_CONTAINER_{ch.upper()}"] = f"{ch}_container_team{idx}"
+        key = ch.upper().replace("-", "_")
+        env[f"CHALLENGE_PORT_{key}"] = str(st["ports"][ch]["chall"])
+        env[f"CHALLENGE_CONTAINER_{key}"] = f"{ch}_container_team{idx}"
         # SSH passwords: checker Challenge.credentials() reads PASSWORD_<self.port>
         # where self.port is the team challenge port.
         pwd = st.get("chall_passwords", {}).get(ch)