fix: respect readonly flag on config-profile mounts in compose tool types

- modify_compose_file now appends :ro when a config-profile volume entry
  has readonly=true, matching the manifest compiler behavior.
- Add a guard for missing tool_type in prepare_manifest_instance.

Quality gates: python3 -m pytest (313 passed, 34 skipped)

apps/api/src/services/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: apps/api/src/services
 
 ## role
-Provides a Python package namespace for organizing service-layer modules in the API application.
+Marks the services directory as a Python package for business logic layer components.
 ## parent
 index: apps/api/src/.pi-map.index.md
 map: apps/api/src/.pi-map.md