test(e2e): add cross-driver userless-image conformance coverage

Description

Create a reusable E2E conformance test proving every supported compute driver can launch an image without a named sandbox passwd/group entry. PR #2335 adds focused Docker and Podman coverage because those identity-injection paths change there, but its review identified that the userless-image contract should also be exercised through VM, Kubernetes, and OpenShift.

Separate driver-specific fixture provisioning from shared behavioral assertions so each E2E lane can supply the same userless image through its supported mechanism.

Context

Related to #1959, #2331, and PR #2335.

Image delivery differs by driver: Docker can build from a local Dockerfile, Podman uses its local image store, VM resolves a local or registry image, and Kubernetes/OpenShift require cluster import or a pullable registry reference. Identity defaults also differ, and OpenShift may select a dynamic UID, so shared assertions must not hardcode 10001.

The current custom_image test selects its Podman path with #[cfg(all(feature = "e2e-podman", not(feature = "e2e-docker")))]. This avoids sending a Podman-local image tag to a Docker gateway when both features are enabled, but Cargo features are additive, so the negative feature gate creates a hidden Docker-wins precedence under --all-features. The reusable suite should select the active driver and its image-provisioning strategy explicitly rather than treating driver features as mutually exclusive.

Definition of Done

• Extract shared userless-image behavioral assertions from the local-driver test.
• Parameterize the fixture image reference and any driver-specific expected identity.
• Provision the fixture for Docker, Podman, VM, Kubernetes, and OpenShift E2E lanes.
• Verify the process runs as a non-root numeric identity without requiring a matching passwd/group entry.
• Verify driver-owned identity values override conflicting image environment values.
• Verify HOME=/sandbox and successful writes under /sandbox.
• Provide focused commands for running the conformance test in each driver lane.
• Remove the not(feature = "e2e-docker") driver-selection workaround; compiling multiple driver features must not silently suppress Podman coverage or select Docker by precedence.
• Make each E2E lane select its driver-specific fixture provisioner explicitly while reusing the same behavioral assertions.

Start with the current custom_image E2E test and its driver feature-selection logic. Compare the Docker, Podman, VM, Kubernetes, and OpenShift fixture mechanisms, then extract shared assertions while keeping provisioning and expected identities driver-specific. Done means every lane runs the userless image checks and multiple driver features no longer silently choose Docker over Podman.