rules(cli): a listing reads the published catalog, not only what you pulled

[elronbandel]

Closes #512. Rules only — the code that depends on it lands separately
(contributing rule 2).

The rule today

14. List. eval-containers list benchmarks|agents|models — MUST read Docker image labels. No separate database or index.

That has one workable reading, and it is what the code does: docker images to
find them, docker inspect to read them. So list answers only for images
already pulled to the local daemon — nothing at all on a clean machine, and
never the question a listing is asked: what can I run?

What changed

• Rule 14 now says where the labels may be read from: the fleet's published
  catalog (evals/catalog:latest, written by the release from those same LABEL
  lines), or the checkout's containers/*/*/Dockerfile under --local. The
  prohibition that matters is kept verbatim in spirit — the CLI keeps no index
  of its own.
• Underlying tools: curl added, for the three HTTP calls that read the
  catalog (anonymous token, manifest, one blob). Adding a tool is itself a rule
  change and is recorded in the changelog, as the table requires.

Why the catalog is not the index the rule forbids

The concern behind "no separate database or index" is a hand-maintained list
that drifts from the components. The catalog is derived — by the publisher, at
publish time, from the components' own labels — so nothing is stored that a
component does not declare, and there is nothing to keep in step by hand. Same
source of truth, published.

Rules checked against

• .agents/meta/rules/RULES.md — the rule states an inspectable property of the
  finished artifact, and the change is recorded in this file's changelog with its
  reason (no silent drift).
• .agents/contributing/RULES.md 1 (resolves rfc: .agents/src/RULES.md#14 — a listing should read the published catalog, not only images you pulled #512), 2 (rules only — no
  code in this PR), 3 (this section), 4 (no tool attribution).

Follow-up

The code PR makes list read the catalog by default and --local read the
checkout, and extends fleet-catalog.sh to carry the per-component labels a
listing shows.

Noticed while writing this, not in scope: cli/src/build.rs shells out to
bash (to run a benchmark's build.sh), which is not in the tools table
either — that is drift, and wants its own issue.

[elronbandel]

Superseded: the fleet now publishes an index (#519), so the rule and the code both point at that instead of the catalog — #552.