Add opt-in Docker executor integration tests against real Podman

Depends on !6990 (merged) for one test to pass

This branch is based directly on main (not stacked on !6990 (merged)), and doesn't touch any file !6990 (merged) touches, so there's no merge-order requirement or conflict risk between them.

The one exception is TestPodmanCommandWithPlatformKey, which is a regression test for the fix in !6990 (merged) -- it will genuinely fail if run locally on this branch before !6990 (merged) merges, reproducing the exact bug fixed there. This is expected and fine: it never runs in CI regardless (see below), so it can't break anything. Once !6990 (merged) merges and this branch is rebased onto main, it'll pass.

What does this MR do?

Adds three local, opt-in integration tests that run the real Docker executor against a real local Podman daemon (not a mock), covering scenarios listed in the test matrix of #31043, plus one regression test:

• TestPodmanCommandBasicRun -- a job runs successfully against Podman at all.
• TestPodmanCommandWithNonRootUser -- a container process running as a non-root user, mirroring the existing TestDockerCommandWithUser.
• TestPodmanCommandWithPlatformKey -- an end-to-end regression test for #39608 (closed), one level up from the client-layer unit tests in !6990 (merged).

There is currently no Podman installation in CI (no podman reference anywhere in .gitlab-ci.yml), so all three tests skip themselves via a podmanHost() helper when no reachable Podman API socket is found, rather than failing. They're meant to be run locally by a contributor who has Podman installed:

go test -tags integration ./executors/docker/... -run TestPodman -v

podmanHost() discovers the socket two ways: a running podman machine (macOS/Windows, where Podman runs inside a VM) or a native Podman socket (Linux). It does not start anything itself -- it only skips cleanly if neither is reachable.

This does not close 31043 -- it covers 3 of its ~4 test-matrix cells (rootless Podman, root and non-root container user) and doesn't touch rootful Podman, services with FF_NETWORK_PER_BUILD, or the doc-update checklist item.

Testing

• Verified locally against a real Podman 5.8.2 machine: TestPodmanCommandBasicRun and TestPodmanCommandWithNonRootUser pass on this branch as-is; TestPodmanCommandWithPlatformKey fails with the exact error from #39608 (closed) on this branch (expected, since it needs !6990 (merged)'s fix), and passes once !6990 (merged)'s commits are present.
• Verified all three tests skip cleanly (rather than failing) with podman removed from PATH, so this can't break CI or any environment without Podman.
• make lint passes with 0 issues.

Marked as draft pending review -- split out of !6990 (merged) to keep that MR scoped to the platform-key fix and its unit tests.

A separate, pre-existing bug found while verifying !6990 (merged)'s fix (bare platform architecture strings resolving to the runner host's OS) is tracked and fixed independently, and doesn't affect this MR: #39622 (closed) / !6993 (merged)