containertool: add --expose and --label flags

[krishnapermi]

Closes #88
Closes #90

Adds two new CLI flags to containertool, addressing the feature requests in the parent issue #91.

--expose <port>

Marks a network port as exposed in the image's OCI configuration. The flag can be repeated. Bare numbers are normalised to the default /tcp suffix (--expose 8080 -> 8080/tcp); explicit protocol suffixes are preserved as-is (8080/tcp, 53/udp). New entries are merged with any ports already present in the base image.

--label <key=value>

Applies an OCI image label. Like --expose, repeatable. Labels are merged with any already set by the base image; a --label value wins on key collision. Entries that don't contain = are rejected at validation time with a clear error.

Both flags follow the pattern established by --env: declared in ImageConfigurationOptions with parsing: .singleValue, passed as typed parameters to publishContainerImage, and merged into inheritedConfiguration before the ImageConfiguration is assembled.

I noticed these two issues while going through the open issue list after submitting #175. The OCI config schema already had ExposedPorts and Labels fields in Schema.swift - it was just a matter of wiring up the CLI surface and the merging logic.