feat: implement pluggable runtimes

[dungdm93]

Summary

This PR implements Pluggable Runtimes (OCI container images as plugins, e.g. drassi/node:24, drassi/python:3.12) in Drassi across Host, Incus, and Container/Docker sandboxers.

Key Changes

1. Runtime Configuration (core/config):

   • Added support for pluggable config.Runtime options (image, alias, subpath, executable, cmd, paths).
   • Decoupled concrete sandboxers from config using config.RegisterSandboxer factory registry to avoid import cycles.

2. Provisioning Engine (core/pkg/runtime/provision):

   • Introduced type-safe provision.Context with Go 1.27 generic methods (Set[T], Get[T], MustGet[T]) and StateKey[T].
   • Created unified provision.Operation interface (PreLaunch, PostLaunch) and provision.Pipeline.
   • Implemented shared operations: provision.Pull, provision.Mount, and provision.ConfigurePathEnv.

3. Storage Management (core/pkg/runtime/storage):

   • Implemented storage.Manager encapsulating go.podman.io/storage and go.podman.io/image/v5.
   • Singleflight deduplicated image pulling.
   • Ephemeral Copy-On-Write (COW) layer mounting and lifecycle teardown hooks.

4. Runtime Registry (core/pkg/runtime):

   • Implemented runtime.Registry with direct and alias lookup (e.g., node20, node22 -> node).
   • Implemented runtime.Runtime with command templating ({0} substitution with script paths).

5. Sandboxer Integration:

   • Host: host.Symlink operation for symlinking mounted runtime trees into the host layout.
   • Incus: incus.DiskDevice operation for host-to-container disk device mappings.
   • Container: container.BindMount and container.ImageMount operations for container spec mounts.

6. Action Executor & DI Wiring:

   • Integrated nodeActionExecutor in action_node.go to resolve its runtime in the init phase via DI without touching action_script.go.
   • Provided runtime.Registry in core/wire/runtime/module.go.

Verification

• Full test suites pass across core, runner-gha, and runner-gitea.
• Comprehensive unit and integration test coverage for all new packages and operations.