catalog: local overlay (global + user merge) for BYO image bindings (spore-host#392)

[scttfrdmn]

Part of the BYO-image catalog model (design: spore-host#392).

Scope (libs/catalog)

• Load order: embedded global catalog → merge a user overlay if present. Sources (precedence): --catalog <path> > $SPAWN_CATALOG > ~/.spawn/catalog.yaml.
• Merge semantics: overlay entry by name rebinds/extends the global entry (notably its image binding); overlay may add brand-new apps. Overlay > embedded on conflict.
• Keep the existing embedded-only API working (overlay is opt-in; no file = today's behavior).
• Overlay entries are not subject to the global public-only validation (that's CI-only on the embedded catalog).

Out of scope

The --image/--app-version ad-hoc CLI override and pull-auth live in spawn.

Refs spore-host#392, #290.