test(test-guest): support rootful Podman gateways - #3184

Summary

Add reusable test-guest configuration for rootful Podman and consolidate Podman gateway provisioning behind a single mode-aware role. This provides the VM and Ansible foundation needed by the delayed-bind fix and its conformance coverage in PR #2874.

Related Issue

No issue required: this is focused test infrastructure for the localized Fedora rootful Podman regression addressed by PR #2874.

Changes

• Add a rootful Podman test-guest configuration that installs Podman, enables its system API socket, and records the selected mode.
• Replace the rootless-specific gateway provisioner with a single gateway-podman role that selects the root or openshell service account from the configured Podman mode.
• Share development and RPM gateway lifecycle handling between rootless and rootful modes without overwriting package-owned gateway configuration.
• Update the existing rootless conformance caller to use the generic provisioner.

Try it in a VM

To inspect the rootful Podman configuration on this PR:

nix run .#test-guest -- \
  --distro fedora \
  --with podman-rootful

The runner opens an interactive SSH session after configuring the guest. Verify the rootful runtime and API socket with:

sudo podman info --format "{{.Host.Security.Rootless}}"
sudo systemctl status podman.socket

The Podman rootless value should be false.

To exercise the complete RPM gateway path, apply the stacked delayed-bind fix from PR #2874 and run:

nix run .#test-guest -- \
  --distro fedora \
  --with podman-rootful \
  --with selinux \
  --install ./openshell.rpm \
  --install ./openshell-gateway.rpm \
  --provision openshell-rpm \
  --provision gateway-podman

Without PR #2874, the full gateway invocation exposes the delayed bridge-bind failure that the stacked PR fixes. With the fix applied, provisioning waits for the root-owned gateway to become healthy and then opens the interactive SSH session.

Testing

• mise run pre-commit passes
• nix run .#test-guest -- --list
• Runner rejects mutually exclusive Podman configurations and a Podman gateway without a Podman configuration
• Unit tests added or updated (not applicable)
• E2E tests added or updated (enabled by the stacked PR)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)