feat(cli): add extra bind mounts for suave docker run

[Rezenders]

What

Adds user-configurable extra bind mounts to the suave CLI:

suave docker mount add ../my_package        # → <container_workspace>/src/my_package
suave docker mount add ~/data --to /data
suave docker mount remove /data             # by host path or container path
suave docker mount list                     # default + extra mounts (missing sources flagged)
suave docker run --mount HOST[:CONTAINER]   # one-off, added to the saved ones
suave docker run --no-extra-mounts          # skip saved ones for this run

Why

Mounting a package from outside the checkout (e.g. a managing system in the enclosing workspace) previously needed suave docker run -- -v a:b, which wasn't persisted and made the mount-drift check warn on every later run.

How

• config.py: new kind='list' for KeySpec, new extra_mounts key (stored as a multi-line INI value; newline or comma separated for config set), Settings.get_list(), list rendering in config show. normalize() checks syntax only: HOST:CONTAINER, both absolute.
• container.py: build_mounts() is split into default_mounts() + extra_mounts(). check_extra_mounts() requires an existing host path (Docker would otherwise create a root-owned folder), and rejects destinations that equal, nest inside, or contain another active mount's destination. It runs only in docker run and mount add.
• Host paths are stored with Path.resolve() so they compare equal to docker inspect's mount sources, which keeps the existing drift warning accurate.
• mount add/remove print a --recreate hint when the container already exists. mount remove tolerates a malformed config so a bad entry can be removed.

Reviewer notes

• Filesystem checks are deliberately kept out of config normalization, so deleting a mounted folder doesn't break suave build, config show, etc. A test covers this.
• There's no read-only (:ro) support and no env var. Both were left out to keep scope small.
• Docs: suave_cli/README.md, docs/source/cli.md, CLAUDE.md, AGENTS.md, CLI help epilogs.

Testing

• suave self-test: 149 passed, flake8/pep257 clean. New tests cover list normalization, the INI round trip, build/validation of mounts, and the full mount add/list/remove flow through main.main.
• Checked by hand in a scratch checkout with --dry-run docker run. I haven't tried a real docker run with an extra mount.

🤖 Generated with Claude Code