Install nested rootless Podman and expose launcher security modes

[arran4]

Summary

• Install the Debian Podman CLI/engine, uidmap, FUSE-overlay storage and rootless networking dependencies inside the canonical development image. Allocate in-container subordinate UIDs/GIDs and a private rootless store rather than depending on a host runtime socket.
• Both Docker and Podman launchers default to nested-Podman-compatible FUSE/seccomp/SELinux settings for new containers. --podman-security=off|nested|unconfined|privileged (or DEV_PODMAN_SECURITY) controls outer confinement. DEV_PODMAN_PERSIST=1 gives Podman a per-project volume independent of Docker, home, and workspace.
• Initialize the private runtime directory and optional storage volume mount root at startup, preserving existing Docker-in-Docker behaviour and stopped-container layout.

Usage

run-dev-docker.sh (or run-dev-podman.sh) uses nested by default. On hosts where AppArmor blocks nested user namespaces, use --podman-security=unconfined; privileged is a broader fallback. off retains the ordinary outer security profile, but nested Podman may fail. The default mode requires /dev/fuse on the host; changing flags does not update already-created containers. Check podman info and podman run --rm docker.io/library/alpine:latest true inside a newly built sandbox to verify actual runtime support.

Testing / review blockers

• Launcher tests were expanded to cover flag precedence, invalid modes, privileged mode and the independent storage mount. They have not been executed in this tool environment.
• sh -n, test-home-volume.sh, image-build tests, live rootless Docker/Podman smoke tests, and the chezmoi apply check have not run here; the container runtime has no /dev/fuse, and GitHub/network access from its shell is unavailable.
• Documentation blocker: the canonical containers/dev-dotfiles-debian/README.md has not yet been updated; keep this PR draft until it documents the installed Podman engine, the launcher flag, host FUSE/namespace prerequisite, optional storage persistence, security consequences, migration and smoke test. Check Debian stable package availability and rootless user-namespace support in the built image before marking ready.
• Do not merge until a smoke test confirms that the chosen outer mode actually runs inner Podman on the target host and the README is synchronized.