Explore rootless container-runtime support for `server container install`

Follow-up to MIR-1311. miren server container install now supports Docker and rootful Podman. This tracks exploring rootless Podman support, which is currently blocked.

Under rootless podman the server and its embedded components (etcd, buildkit, victoria-metrics/logs) come up fine and the control plane answers — but no app sandbox can start. Every sandbox boot fails at runc create ... can't get final child's PID from pipe: EOF.

Root cause is a chain of privilege assumptions baked into the sandbox spec that a rootless (fake-privileged) container can't satisfy. We walked it empirically on macOS podman 6.0 (rootless), building a patched image to advance one domino at a time:

1. oom_score_adj = -998 on the pause container (controllers/sandbox/sandbox.go:1685, WithOOMScoreAdj(defaultSandboxOOMAdj, false)). Lowering oom_score_adj needs CAP_SYS_RESOURCE. Confirmed fixable and validated live: flipping restrict → true clamps the value and the pause container boots. (containerd's CRI calls this restrict_oom_score_adj.)
2. App container joins the pause's time namespace (sandbox.go:2332, setns into /proc/<pid>/ns/time → "Operation not permitted"). Observed live once #1 was fixed. Likely fixable by dropping the TimeNamespace join (may be unnecessary).
3. mknod of default /dev nodes (WithDefaultUnixDevices) needs CAP_MKNOD. Standard rootless fix: bind-mount device nodes instead of mknod. (Not yet reached in testing; identified from the code.)
4. Network wiring — rt0 bridge + veth + iptables (CAP_NET_ADMIN). Probably works since it all happens inside the container's own netns where a --privileged rootless container does hold CAP_NET_ADMIN, but unverified.

Line of sight: no fundamental blocker found — it's a finite chain of the same accommodations that containerd's own rootless CRI mode already makes (it literally logs "Running CRI plugin in a user namespace typically requires disable_apparmor and restrict_oom_score_adj to be true"). The work is a "rootless-aware sandbox spec" path: detect rootless, relax these things. The one unproven step is the network layer, but it happens in our own netns so it should hold.

Related constraint: even rootful, LSVD provider = "miren" disks don't work rootless (/dev/loop-control needs CAP_SYS_ADMIN) — a separate limitation; provider = "local" disks are the rootless-compatible option.

Interim (separate small change): server container install should detect rootless podman and refuse with a clear message pointing at rootful/Docker, gated behind --force for control-plane-only testing.