ci: re-add rootless Podman e2e using Nix VMs

Description

Re-add rootless Podman e2e coverage using Nix-based VMs instead of the current GitHub-hosted Ubuntu rootless Podman lane.

Context

The current rootless Podman CI lane runs directly on an Ubuntu hosted runner and hand-configures Podman, conmon, AppArmor, subuid/subgid ranges, and pasta behavior in .github/workflows/e2e-test.yml. That setup is sensitive to hosted-runner image changes and distribution package behavior, which makes failures hard to separate from OpenShell regressions.

The replacement should run rootless Podman scenarios inside a reproducible Nix-managed VM image. The VM should make the host policy, Podman version, network backend, user namespace configuration, and rootless socket setup explicit and versioned with the repository.

Definition of Done

• A Nix-based VM test environment provisions rootless Podman with pinned or otherwise reproducible versions.
• The VM test environment verifies rootless mode before running OpenShell e2e tests.
• The restored e2e path covers the rootless Podman gateway flow that was previously exercised by e2e:podman:rootless.
• CI can invoke the Nix VM rootless Podman lane without relying on mutable hosted-runner Podman/AppArmor configuration.
• Documentation or contributor-facing task references explain how to run the new rootless Podman VM lane locally or in CI.

Start with .github/workflows/e2e-test.yml and the existing e2e:podman:rootless lane to understand its current coverage and configuration. Define the Nix-based VM environment, verify rootless mode before running the OpenShell gateway flow, and add contributor-facing run instructions; done means CI runs the restored lane without mutable hosted-runner Podman or AppArmor setup.