imagecache: probe for overlayfs lowerdir+ support and fall back to legacy mount(2) on pre-6.5 kernels

Follow-up to #467 review feedback (https://github.com/agent-substrate/substrate/pull/467#discussion_r3634283963).

`SetupBundleRootfs` mounts actor rootfs overlays via the new mount API (`fsopen` + one `fsconfig` `lowerdir+` append per layer), which lifts the mount(2) single-page option cap (~34 digest-derived layer paths) but requires Linux ≥ 6.5. All current GKE COS channels qualify (Stable: COS 121 LTS, kernel 6.6), but GKE Ubuntu node images and developer hosts running kind on older kernels (Ubuntu 22.04 GA = 5.15) do not — and there, every actor mount fails with a per-actor `EINVAL`, which reads as flakiness rather than an environment problem.

Proposed fix:
- Probe `lowerdir+` support once at ateom startup (cheap `fsopen`/`fsconfig` dry run against a scratch dir).
- When absent, fall back to legacy `mount(2)` option-string assembly. This is graceful degradation: pre-6.5 kernels cannot mount >~34-layer chains by any mechanism, so the fallback only fails where the kernel itself is the limit.
- Log one clear line at startup ("kernel lacks overlayfs lowerdir+ (need >= 6.5); using legacy mount, images beyond ~34 layers will fail") and include the kernel hint in the legacy path's over-length preflight error.

~40 lines + tests (the legacy assembly existed before cf77497d/77026523 and can be resurrected from history).