catalog: visibility field + image-less definitions (BYO model, spore-host#392)

[scttfrdmn]

Part of the BYO-image catalog model (design: spore-host#392).

Scope (libs/catalog)

• Add Visibility (public|private) to AppEntry, with inference helper: public.ecr.aws/*→public, *.dkr.ecr.*.amazonaws.com/*→private; explicit value wins.
• Make image-less definitions first-class: an entry with neither image nor launch_command is valid as a definition (hardware/DCV spec) — it's launchable only once an overlay/--image supplies a binding. Update Validate()/validateApps so "not launchable" is no longer an error for a definition-only entry in isolation (the launch-time check enforces a binding).
• Containerized() stays; add ImageRef()/visibility accessors as needed.

Out of scope

Overlay loading + launch (spawn side) and the online resolvability gate (separate issues).

Refs spore-host#392, #290.

[scttfrdmn]

Correction (per spore-host#392 update): drop the 'image-less definitions are first-class listable entries' part. The catalog is a launchability-filtered view — an entry is listed only if its image resolves for the current account. Keep the visibility field; an entry with no resolvable image is simply hidden, not shown. So Validate() shouldn't treat image-less entries as valid listable apps; listability is decided at runtime by the resolvability filter (spawn#266).