[Bug]: `container run --label` rejects a label whose value contains "="

### Steps to reproduce

```
container run --rm --label 'config=key=value' alpine true
```

### Current behavior

```
Error: invalid label format config=key=value
```

Any `--label KEY=VALUE` whose value contains a `=` is rejected — for example a reverse-proxy router rule (`--label 'traefik.http.routers.x.rule=Host(\`ex.com\`)'`) or a nested `key=value` configuration value. A label with no `=` in the value works.

### Expected behavior

The label is accepted with the value kept intact (`key=value`), matching `docker run --label`, which splits the label on the first `=` only.

### Root cause

`Parser.labels` splits each entry with `label.split(separator: "=", maxSplits: 2)` and only handles 1 or 2 parts, throwing for anything else. A value containing `=` produces 3+ parts and hits the `default` (throw) branch. It should split on the first `=` only — the env-file parser already does this (`URL=https://foo.bar?baz=woo` is accepted).

### Environment

- container 1.1.0
- macOS 26.5 (Tahoe), Apple Silicon

Start at Parser.labels and compare its splitting behavior with the env-file parser, which accepts values such as URL=https://foo.bar?baz=woo. Run the reported container run command and verify that the label is accepted with key=value preserved intact, matching docker run behavior.

Written by the indexing model from the issue text.