Study container runtime alternatives to podman

[troglobit]

Investigate possibility of replacing podman with something closer to our core values of immutability, security, and usability.

At the time of this, 2025-10-06:

• AppTainer — "Secure. Portable. Encryptable."
• Lilypod — "a simple[^1] container manager"
• Incus — Continuation of the lxd project, which was the high-level tool for lxc, but with OCI support, aimed at system containers. See also https://linuxcontainers.org/incus-os/introduction/

[^1]: Note, no seccomp, no cgroups, no capabilities. For more information on this, see these notes. However, these are properties that we could add to Finit services and benefit from with regular system services as well 🤔

[wkz]

CCB:

Requirement: Being able run from a Squash or EROFS (immutable image)

Pick up this work in ~Jan timeframe