Replace the podman-based runtime with nerdctl running inside the Lima
VM introduced in the previous commit. OpenClaw is cut over to the new
VM-backed container runtime; legacy podman code paths are removed.
- New container CLI (lib/container): nerdctl ContainerCli, ImageLoader
with cache-tarball fallback, shared types
- OpenClaw: container-runtime-factory orchestrates VM lifecycle + gateway
startup; container-runtime.ts rewritten to speak nerdctl; Linux test
startup kept disabled behind the factory
- Terminal: session + routes moved onto Lima shell transport; server
wires the VM-backed runtime via main.ts
- Agent UI: simplify AgentsPage/useOpenClaw after route consolidation
- Remove podman-runtime, podman-overrides, and their tests
- Tests: container-cli, image-loader, container-runtime-factory, and
updated openclaw/terminal/main suites
