fix(release): package supported microsandbox targets

[pepicrft]

Summary

• Installs libcap-ng-dev in the Linux release packaging job so once-cli can link the embedded Microsandbox provider.
• Limits the embedded Microsandbox dependency to Linux and Apple Silicon macOS, avoiding the Intel macOS dependency path that fails in msb_krun_utils.
• Keeps unsupported targets on the existing provider configuration error path.

Testing

• mise exec -- cargo check -p once-cli
• rustup target add x86_64-apple-darwin
• mise exec -- cargo check -p once-cli --target x86_64-apple-darwin
• mise exec -- cargo clippy -p once-core --all-targets -- -D warnings
• mise exec -- cargo fmt --all -- --check
• git diff --check
• rg -n "—" .github/workflows/release.yml crates/once-core/Cargo.toml crates/once-core/src/remote/microsandbox.rs || true