Follow-up to #229. That PR added the env var only to
`docker-compose.yml`, which fixes our own hosts (we pull the compose
file when the launch template is rebuilt) but leaves every external
operator exposed:

* Watchtower's auto-update flow pulls the new stable image and
  recreates the container using the operator's *existing* compose
  file. If they haven't pulled the compose change from #229 —
  most haven't — the env var is unset, `bittensor 10.5.0`'s
  `no_parse_cli()` defaults to `"true"`, and `Config(parser)` early-
  returns without applying `--wallet.name`/`--wallet.hotkey`/
  `--netuid`/`--subtensor.network`. Fallback defaults
  (netuid=None, wallet=default, network=finney) hit a runtime panic
  at metagraph sync — the exact crash we chased on staging.

Baking `ENV BT_NO_PARSE_CLI_ARGS=false` into the Dockerfile makes the
image safe by default. Compose-side setting stays as belt-and-
suspenders (image ENV is overridden by compose environment: block,
but the values match, so no conflict).

Design principle for follow-ups: env vars the runtime *needs to boot*
belong in the image. Compose should carry only site-specific config
(wallet name, netuid, backend URL, watchtower token). Otherwise every
image upgrade is coupled to a compose sync that we can't enforce on
external validators.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>