feat: raw-TCP exposure with castle-managed TLS + reach model

Expose raw-TCP services (postgres) by name at <name>.<domain>:<port> and
cut the gateway's ACME wildcard cert onto them so they present a trusted
cert. Replaces the proxy/public booleans with a single `reach` enum
(off|internal|public); legacy input still parses via derived accessors.

Core:
- expose.tcp{port,tls} + TlsSpec(material: pair|combined|off, reload)
- tls.py: materialize cert files from Caddy's wildcard, reconcile on
  renewal; `castle tls` CLI; optional cert_obtained events-exec hook
  (gateway.cert_hook, gated so a plugin-less Caddy still parses)
- apply waits (bounded) for the wildcard to issue before materializing so
  a fresh-node TLS service starts with its cert in place, then scopes
  materialization to the deployments being applied
- reach: internal|public requires an expose block (no silent no-op);
  public raw-TCP guarded until tunnel support lands
- chain.pem (${tls_ca}) is the issuer chain (leaf stripped), a real CA
  bundle distinct from cert.pem
- one shared ${...} resolver (resolve_placeholders) for env and container
  run fields; run.env now expands like volumes/args; $$ escapes a literal
- validate the generated Caddyfile before reloading the gateway so an
  invalid config never degrades routing

Docs: docs/tcp-exposure.md. Tests cover reach/expose validation,
placeholder expansion + escape, issuer-chain material, TLS materialize.

core/tests/test_deploy_run_cmd.py

@@ -107,6 +107,45 @@ def test_container_without_secrets_has_no_env_file() -> None:
     assert "--env-file" not in cmd
 
 
+def test_container_placeholders_expand_in_run_fields() -> None:
+    """${key} placeholders expand consistently across a container's env, volumes,
+    and args — env used to be the odd one out that passed through literally."""
+    run = RunContainer(
+        launcher="container",
+        image="img:latest",
+        env={"DATA": "${data_dir}/x"},
+        volumes=["${tls_dir}:/tls:ro"],
+        args=["--advertise", "${name}:${port}"],
+    )
+    ph = {
+        "name": "svc",
+        "port": "5432",
+        "data_dir": "/data/castle/svc",
+        "tls_dir": "/data/castle/svc/tls",
+    }
+    with patch("castle_core.deploy.shutil.which", return_value="/usr/bin/docker"):
+        cmd = _build_run_cmd("svc", run, {}, [], placeholders=ph)
+    joined = " ".join(cmd)
+    assert "DATA=/data/castle/svc/x" in joined       # env expanded
+    assert "/data/castle/svc/tls:/tls:ro" in joined  # volume expanded
+    assert "svc:5432" in cmd                          # arg expanded
+
+
+def test_container_double_dollar_escapes_placeholder() -> None:
+    """$${key} passes a literal ${key} through to the container's own shell/env
+    instead of castle expanding it (docker-compose-style escape)."""
+    run = RunContainer(
+        launcher="container",
+        image="img:latest",
+        args=["sh", "-c", "exec myd --advertise $${name}:${port}"],
+    )
+    ph = {"name": "svc", "port": "5432"}
+    with patch("castle_core.deploy.shutil.which", return_value="/usr/bin/docker"):
+        cmd = _build_run_cmd("svc", run, {}, [], placeholders=ph)
+    # castle expands ${port} but leaves $${name} as a literal ${name} for the shell
+    assert "exec myd --advertise ${name}:5432" in cmd
+
+
 def test_compose_runner_up_with_resolved_file(tmp_path: Path) -> None:
     """A compose service runs `docker compose -p <project> -f <abs-file> up`."""
     run = RunCompose(launcher="compose", file="docker-compose.yml")