werkdock: ordered mounts with --tmpfs, images verb, :rw accepted

Session C groundwork: Werkator's git-metadata mask needs a tmpfs
BETWEEN binds (ro-bind .git, tmpfs .git/werkator, bind workspace), so
-v and --tmpfs now collect into one ordered mount list and RunSpec
carries Mounts instead of Binds. --tmpfs DEST is the docker flag of the
same name. `werkdock images` lists loaded image names one per line, so
a consumer can check existence through the CLI. -v accepts the explicit
:rw docker default instead of refusing it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/engine/engine.go

@@ -3,12 +3,25 @@
 // logic without duplicating it (RFC 0002).
 package engine
 
-// Bind is one bind mount, applied in order; later mounts shadow earlier
-// ones at their own path, exactly as bwrap layers them.
-type Bind struct {
-	Source   string
-	Dest     string
-	ReadOnly bool
+// MountMode distinguishes the mount kinds a RunSpec can carry.
+type MountMode int
+
+const (
+	// MountBind is a read-write bind mount.
+	MountBind MountMode = iota
+	// MountRoBind is a read-only bind mount.
+	MountRoBind
+	// MountTmpfs is an empty tmpfs at Dest; Source is unused.
+	MountTmpfs
+)
+
+// Mount is one mount, applied in order; later mounts shadow earlier
+// ones at their own path, exactly as bwrap layers them — the order of
+// -v and --tmpfs flags is therefore significant and preserved.
+type Mount struct {
+	Mode   MountMode
+	Source string
+	Dest   string
 }
 
 // EnvVar is one environment variable; order is preserved.
@@ -23,7 +36,7 @@ type RunSpec struct {
 	// RootFS is the absolute path to the unpacked image rootfs,
 	// bound read-only at /.
 	RootFS  string
-	Binds   []Bind
+	Mounts  []Mount
 	Env     []EnvVar
 	Workdir string
 	Command []string