Add mcp build command and deploy auto-build

Extends MCP to own the full build-push-deploy lifecycle. When deploying,
the CLI checks whether each component's image tag exists in the registry
and builds/pushes automatically if missing and build config is present.

- Add Build, Push, ImageExists to runtime.Runtime interface (podman impl)
- Add mcp build <service>[/<image>] command
- Add [build] section to CLI config (workspace path)
- Add path and [build.images] to service definitions
- Wire auto-build into mcp deploy before agent RPC
- Update ARCHITECTURE.md with runtime interface and deploy auto-build docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/config/cli.go

@@ -3,6 +3,7 @@ package config
 import (
 	"fmt"
 	"os"
+	"strings"
 
 	toml "github.com/pelletier/go-toml/v2"
 )
@@ -10,11 +11,17 @@ import (
 // CLIConfig is the configuration for the mcp CLI binary.
 type CLIConfig struct {
 	Services ServicesConfig `toml:"services"`
+	Build    BuildConfig    `toml:"build"`
 	MCIAS    MCIASConfig    `toml:"mcias"`
 	Auth     AuthConfig     `toml:"auth"`
 	Nodes    []NodeConfig   `toml:"nodes"`
 }
 
+// BuildConfig holds settings for building container images.
+type BuildConfig struct {
+	Workspace string `toml:"workspace"`
+}
+
 // ServicesConfig defines where service definition files live.
 type ServicesConfig struct {
 	Dir string `toml:"dir"`
@@ -66,6 +73,9 @@ func applyCLIEnvOverrides(cfg *CLIConfig) {
 	if v := os.Getenv("MCP_SERVICES_DIR"); v != "" {
 		cfg.Services.Dir = v
 	}
+	if v := os.Getenv("MCP_BUILD_WORKSPACE"); v != "" {
+		cfg.Build.Workspace = v
+	}
 	if v := os.Getenv("MCP_MCIAS_SERVER_URL"); v != "" {
 		cfg.MCIAS.ServerURL = v
 	}
@@ -93,5 +103,15 @@ func validateCLIConfig(cfg *CLIConfig) error {
 	if cfg.Auth.TokenPath == "" {
 		return fmt.Errorf("auth.token_path is required")
 	}
+
+	// Expand ~ in workspace path.
+	if strings.HasPrefix(cfg.Build.Workspace, "~/") {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return fmt.Errorf("expand workspace path: %w", err)
+		}
+		cfg.Build.Workspace = home + cfg.Build.Workspace[1:]
+	}
+
 	return nil
 }