feat: translate config MCP placement into sidecars in the library

[tgockel]

LaunchSpec::from_image_config copied an image config's [mcp] map verbatim and left sidecars empty, so placement-bearing entries (sidecar = "", inline image = "...") survived into LaunchSpec.mcp and Outrig::launch rejected them, pointing at with_sidecar / add_sidecar. That deferred the faithful translation, recorded in the 0081 decisions.

Replace it with an async LaunchSpec::from_config(&Config, image_name, repo_root, log_dir). Faithful named-sidecar image resolution needs the whole Config -- a sidecar's image may name a sibling [images.] block -- plus async ensure_image, which the old &ImageConfig-only, sync, infallible constructor could not do. It reuses plan_from_config for placement classification, then splits the plan into the primary mcp map and a Vec: primary-hosted servers stay in mcp; each auto sidecar (named or anonymous) becomes a SidecarSpec whose servers carry the entry's normalized command and env.

Sidecar images resolve like --image: a sibling [images.] block builds or pulls, anything else must already exist locally. They are resolved eagerly here, so SidecarSpec.image stays the resolved raw ref it has always been; the primary image is still built lazily by launch, since LaunchSource carries an unbuilt source and SidecarSpec does not.

Three shapes the exec-stdio facade can't represent are handled explicitly: start = "manual" sidecars are skipped (their servers appear nowhere -- rebuild a SidecarSpec and add_sidecar to start one later), entrypoint-stdio placements (inline image, no command) are rejected with an error naming the server, and a sidecar image's own org.outrig.mcp label is not merged. The CLI path remains the strict superset for all three.

The translation is split into a pure plan_to_launch_parts (partition, manual-skip, entrypoint-reject, leaving each image ref unresolved) plus an async resolver, matching the podman-free-testing seam that plan_from_config already established; six unit tests exercise the decision logic without containers, and a library_surface e2e drives a config-name sidecar through a real launch. from_image_config had no callers, so removing it is a clean break of an unused public constructor; toml joins the outrig dev-dependencies so the e2e test can build a Config fixture.

Summary

What does this change, and why?

Checklist

• cargo fmt --all -- --check passes
• cargo clippy --workspace --all-targets -- -D warnings is clean
• cargo test --workspace passes
• Docs in doc/ updated if behavior changed (mdbook build still clean)
• CHANGELOG updated for user-visible changes

Notes for reviewers

Anything worth calling out -- tricky bits, follow-ups, or intentionally out-of-scope items.