fix: make challenge toggle actually work end-to-end (5 root-cause bugs)

Found by testing a real enable/disable cycle (art, fjb, gift-card):

1. compose_gen always swapped build->image, so a never-built challenge
   produced 'pull access denied for services-<name>'. Now it only reuses
   the image when it exists locally, otherwise keeps build: so
   'docker compose up --build' builds it.
2. Canonical templates use 'build: context: .' (written for the shared
   services/ tree). In the per-team compose that resolves to the team dir
   which has no Dockerfile -> 'failed to read dockerfile'. The renderer
   now rewrites the main service's context to ./<name>.
3. Teams created before the XVI/XVII import had no xvi/xvii subpackages
   under their local challenges/ dir, so the regenerated receiver main.py
   crash-looped on import. gen_receiver_main now mirrors ALL shared
   checkers (native + xvi + xvii) into every team receiver on each sync.
4. systemd Environment= keys can't contain hyphens, so
   CHALLENGE_PORT_GIFT-CARD was silently dropped. Keys are now
   normalized to underscores on both the writer and reader side.
5. Several checkers called 'docker exec' with no timeout; against a
   container with accumulated chall.py zombies that blocks forever and
   stalls the whole SLA loop. Added mandatory timeouts (Phew, Sheesh,
   Carbeat, Poke, Warmup).

Also: enabling a challenge now copies its source tree into each team's
services/ dir (team dirs only held challenges enabled at create_team
time), and the XVII checkers were rewritten to be protocol-aware
(gift-card/gift-voucher are socat TCP, not HTTP) with strict timeouts.

receiver/challenges/Sheesh.py

@@ -15,9 +15,10 @@ class Sheesh(Challenge):
     _HEX_RE      = re.compile(r'^[0-9a-fA-F]+$')
 
     def _read_container_flag(self) -> str:
+        # timeout is mandatory: docker exec can block forever on a saturated container
         out = subprocess.run(
             ["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
-            capture_output=True, text=True
+            capture_output=True, text=True, timeout=30
         )
         if out.returncode != 0 or not out.stdout.strip():
             raise FileNotFoundError("Flag not found in container (/flag.txt)")