Wire opt-in Podman integration tests into CI

Relates to #31043, which asks for GitLab Runner to be tested against Podman 5.2.5+ as a standard, recurring maintenance process rather than only via a human running tests locally.

!6991 (merged) added opt-in TestPodman* tests in executors/docker/docker_podman_integration_test.go, but they self-skip whenever no reachable Podman API socket is found, and nothing in CI ever installed Podman, so they never actually ran in the pipeline.

What this MR adds

• A new integration test (docker, podman) job in .gitlab/ci/test.gitlab-ci.yml that installs Podman (apt-get install podman) and starts podman system service --time=0 & (no explicit socket URI, so it binds to Podman's own default path, the same path podmanNativeHost() already checks for) before running the existing -tags integration ./executors/docker suite.
• The socket-wait step exits non-zero if the socket never opens, after printing the Podman service log. podmanHost() self-skips on an unreachable socket, so without that the whole TestPodman* set would skip and the job would still report success.
• A podman import of the prebuilt helper tarball alongside the existing docker import. Podman keeps an image store separate from the dind daemon, and the tarball sits outside every path in PrebuiltImagesPaths, so without it Podman pulls the published helper image rather than the one this pipeline built.
• The job is when: manual, allow_failure: true, matching the precedent of the other opt-in docker-scoped jobs (integration test (docker, steps), integration test (docker, concrete, steps)). Whether Podman can install and start a working API socket inside this specific CI container is unproven (nested-container support, cgroups/user-namespace access are all open questions), so allow_failure keeps a failed setup off the pipeline's critical path.
• Deliberately not narrowed with -run TestPodman: splitic always computes its own -run from every discovered test matching the active build tags and silently overrides any -run passed to it, so the job runs the whole ./executors/docker package (same as the steps/concrete, steps jobs). This means any future TestPodman* additions are picked up automatically with no CI changes needed here.
• Updated the doc comments at the top of docker_podman_integration_test.go, which said these tests never run in the pipeline.

Related MRs

• !7178 (merged) added the TestPodmanRootful* tests to the same file and has merged. This job runs the whole package, so it already picks them up with no changes needed here.
• !7177 (closed) was closed. Documenting the tested Podman configurations should be revisited once this MR's CI wiring is proven.

Verified vs. unverified

• Verified locally: YAML parses (python3 -c "import yaml; ...", with a !reference constructor added), prettier --check passes, gofmt -l is clean, go build/go vet on ./executors/docker/... pass, make check_test_directives passes, golangci-lint run ./executors/docker/... reports 0 issues, and the commit passes gitlab-commit-lint.py.
• Unverified: the actual apt-get install podman, podman system service, and podman import steps have not run against a live GitLab CI runner. The base image is Debian bookworm, whose podman apt package is 4.3.1, below the 5.2.5+ that #31043 asks for; that's a known caveat, noted in a YAML comment, and left as a follow-up once the basic wiring is shown to work at all.