install: Make some "lints" default fatal

TL;DR change `bootc install` to run `bootc container lint --fatal-only` *before* we start an install at all.

---

Our base image has an empty `/var`, and things like RPMs/debs that for legacy reasons write to `/var/run` will create it as a directory which will just break a lot of things, but often not *totally* fatally.

- https://issues.redhat.com/browse/RHEL-25756 (originally https://github.com/CentOS/centos-bootc/issues/140 )
- https://gitlab.com/fedora/bootc/base-images/-/issues/28 (e.g. Fedora's `audit` package has `/var/run`)

We added a lint against this in `RUN bootc container lint` but not many people know to use that yet.

Almost all of what we have as lints today should be fatal at install time by default. The only exception is `usr/etc` needs to be a soft, not hard error for compat today.

(Also we should warn client side too! But install time would help a lot for now)

Commencez par suivre le point d’entrée de `bootc install` et le comportement existant de `bootc container lint --fatal-only`. Vérifiez que les lints fatals sont exécutés avant le début de l’installation, tandis que `usr/etc` reste une erreur non bloquante ; le travail est terminé lorsque le chemin d’installation rejette les images présentant les autres conditions de lint fatal.

Rédigé par le modèle d'indexation à partir du texte de l'issue.