feat(generate): propose fs read for image directories outside the baseline (--image) - #32

Closes #14

generate --image IMAGE inspects the container image (docker, then podman) and prints a stderr proposal of # @openshell fs read <dir> lines for application directories (WORKDIR, ENTRYPOINT/CMD paths, /opt/*, /srv/*, unusual top-level dirs) that fall outside OpenShell 0.1.6's baseline read set and outside the declared fs roots. It only proposes: the policy on stdout is unchanged. No proposal when the code declares no fs directive (no filesystem_policy, nothing restricted) and the WORKDIR is skipped while include_workdir is on.

• src/image.rs (inspect parsing, docker create + export | tar -t listing, proposal logic), --image / --image-inspect FILE flags
• README section; docs/CLI.md regenerated
• Tests: unit tests in image.rs, tests/image_fs.rs (offline via --image-inspect)

Verified against the real context7-openshell:local image with the fs read /opt/context7 directive removed: proposes /opt/context7 (and /opt/yarn-v1.22.22); with the directive present it is silent.

Independent of the other open PRs (new files; small additions in main.rs/lib.rs may need a trivial rebase).