fix(container): probe native overlay permissions and isolate VFS fallback

Summary

Related to #443 (closed). Probe only native OverlayFS permissions/capabilities on the configured graphroot. Root runners with user namespaces do not probe or automatically select FUSE. Native denial selects fresh private VFS graphroot/runroot paths without deleting existing stores; explicit driver overrides are preserved.

Plan

1. Probe native OverlayFS on the configured storage filesystem and stop on probe-unmount failure.
2. Isolate automatic VFS fallback while preserving existing stores, caller configuration and explicit overrides.
3. Verify exact rebased-head complete CI and final DoD before resolving the owner thread and requesting review.

Acceptance criteria

• Native OverlayFS success keeps the configured graphroot and clears inherited FUSE mount programs for that job.
• Only native OverlayFS is probed, even when a permitted FUSE implementation is available.
• Denied native mounts use isolated VFS storage without deleting existing graphroot/runroot data or replacing caller configuration.
• Explicit VFS/OverlayFS overrides and initialized stores are preserved.
• Failed native-probe unmount stops initialization without recursively deleting the mountpoint.
• All 27 local Bash regression suites pass on the rebased head, including native-probe/storage, Cypress and Podman storage suites.
• Final two-file scoped diff reviewed and current-main rebase completed; range-diff confirms both task patches are unchanged.
• Rebased-head complete required CI passes, including generated Buildah/catalog jobs and regression execution.
• Final acceptance, owner-thread resolution and delivery DoD.

Verification

Rebased onto current main c2d484f8; current head is 8b7751ac2019b2bde9659c92c9aee7fad3f1a6d3. Both task commits are patch-equivalent to their previously tested versions. The only additional tree difference is the target branch's existing CVE applicability policy; it is preserved without modification. Local native-only/storage checks, all 27 Bash suites, Bash syntax and whitespace checks pass. Missing local PyYAML, XML reporting and Bashunit dependencies were supplied outside the repository; no source or test assertion was changed.

Exact-head pipeline 3001540011 succeeds at 8b7751ac2019b2bde9659c92c9aee7fad3f1a6d3: all 62 connected pipelines and 61 bridges succeed, with 219 successful jobs and no failed, skipped or unfinished required check. Three pre-existing allowed-failure fixtures exercise Bash failure/JUnit reporting, deprecation warnings and SonarQube findings; their required validators pass. No failure allowance, scan exception or skip was introduced for this change.

The required Bash regression job and downloaded JUnit artifact confirm 27 passing suites, zero failures, errors or skips, including native-only storage, Cypress and Podman checks. Both real Buildah integrations (01, 02) encounter native OverlayFS denial, select private VFS graphroots/runroots, and complete build, push and signing. This verifies the requested capability fallback in catalog CI; it does not claim that the reporter's external runner or registry was repaired.

The two-file final diff is reviewed. A fresh fetch/fast-forward and no-op rebase onto current main c2d484f8 preserve the tested SHA; Bash syntax, whitespace and clean-worktree checks pass. The latest owner amendment is implemented: only native OverlayFS is probed, even when FUSE is available. The owner thread is answered and resolved with exact-head evidence. Public documentation was assessed; no component input or explicit-override interface changed. No runner privilege escalation, shared-store reset or quality bypass is introduced.

Definition of Done

• Owner-requested native-only detection and isolated fallback verified.
• Changes scoped to container storage initialization and its behavioral regression.
• Current-main rebase and final diff review complete; tested source unchanged.
• Exact-head complete required CI and actual regression execution verified.
• Documentation assessed and owner feedback addressed; no remaining implementation work.

Closes #443 (closed)