werkdock: ordered mounts with --tmpfs, images verb, :rw accepted

Session C groundwork: Werkator's git-metadata mask needs a tmpfs
BETWEEN binds (ro-bind .git, tmpfs .git/werkator, bind workspace), so
-v and --tmpfs now collect into one ordered mount list and RunSpec
carries Mounts instead of Binds. --tmpfs DEST is the docker flag of the
same name. `werkdock images` lists loaded image names one per line, so
a consumer can check existence through the CLI. -v accepts the explicit
:rw docker default instead of refusing it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/cli/images.go

@@ -0,0 +1,35 @@
+package cli
+
+import (
+	"flag"
+	"fmt"
+	"io"
+
+	"werkdock/internal/store"
+)
+
+// imagesCmd prints the loaded image names, one per line — machine-usable
+// (Werkator checks image existence through it) and close enough to
+// `docker images --format '{{.Repository}}'`.
+func imagesCmd(args []string) int {
+	fs := flag.NewFlagSet("images", flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	if err := fs.Parse(args); err != nil {
+		return fail(err)
+	}
+	if len(fs.Args()) != 0 {
+		return fail(fmt.Errorf("unexpected argument %q", fs.Args()[0]))
+	}
+	st, err := store.Default()
+	if err != nil {
+		return fail(err)
+	}
+	names, err := st.List()
+	if err != nil {
+		return fail(err)
+	}
+	for _, name := range names {
+		fmt.Println(name)
+	}
+	return 0
+}