fix: make challenge toggle actually work end-to-end (5 root-cause bugs)

Found by testing a real enable/disable cycle (art, fjb, gift-card):

1. compose_gen always swapped build->image, so a never-built challenge
   produced 'pull access denied for services-<name>'. Now it only reuses
   the image when it exists locally, otherwise keeps build: so
   'docker compose up --build' builds it.
2. Canonical templates use 'build: context: .' (written for the shared
   services/ tree). In the per-team compose that resolves to the team dir
   which has no Dockerfile -> 'failed to read dockerfile'. The renderer
   now rewrites the main service's context to ./<name>.
3. Teams created before the XVI/XVII import had no xvi/xvii subpackages
   under their local challenges/ dir, so the regenerated receiver main.py
   crash-looped on import. gen_receiver_main now mirrors ALL shared
   checkers (native + xvi + xvii) into every team receiver on each sync.
4. systemd Environment= keys can't contain hyphens, so
   CHALLENGE_PORT_GIFT-CARD was silently dropped. Keys are now
   normalized to underscores on both the writer and reader side.
5. Several checkers called 'docker exec' with no timeout; against a
   container with accumulated chall.py zombies that blocks forever and
   stalls the whole SLA loop. Added mandatory timeouts (Phew, Sheesh,
   Carbeat, Poke, Warmup).

Also: enabling a challenge now copies its source tree into each team's
services/ dir (team dirs only held challenges enabled at create_team
time), and the XVII checkers were rewritten to be protocol-aware
(gift-card/gift-voucher are socat TCP, not HTTP) with strict timeouts.

receiver/challenges/Phew.py

@@ -14,8 +14,14 @@ class Phew(Challenge):
     _HEX_RE      = re.compile(r'^[0-9a-fA-F]+$')
 
     def _read_container_flag(self) -> str:
-        out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
-                             capture_output=True, text=True)
+        # NB: a timeout is mandatory here. `docker exec` against a container
+        # whose process table is saturated (accumulated chall.py zombies) can
+        # block forever and take the whole SLA check loop down with it.
+        try:
+            out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
+                                 capture_output=True, text=True, timeout=30)
+        except subprocess.TimeoutExpired:
+            raise TimeoutError("docker exec cat /flag.txt timed out (container overloaded?)")
         if out.returncode != 0 or not out.stdout.strip():
             raise FileNotFoundError("Flag not found in container (/flag.txt)")
         return out.stdout.strip()