install: Make some "lints" default fatal

TL;DR change `bootc install` to run `bootc container lint --fatal-only` *before* we start an install at all.

---

Our base image has an empty `/var`, and things like RPMs/debs that for legacy reasons write to `/var/run` will create it as a directory which will just break a lot of things, but often not *totally* fatally.

- https://issues.redhat.com/browse/RHEL-25756 (originally https://github.com/CentOS/centos-bootc/issues/140 )
- https://gitlab.com/fedora/bootc/base-images/-/issues/28 (e.g. Fedora's `audit` package has `/var/run`)

We added a lint against this in `RUN bootc container lint` but not many people know to use that yet.

Almost all of what we have as lints today should be fatal at install time by default. The only exception is `usr/etc` needs to be a soft, not hard error for compat today.

(Also we should warn client side too! But install time would help a lot for now)

Start by tracing the `bootc install` entry point and the existing `bootc container lint --fatal-only` behavior. Confirm that fatal lints run before installation begins, while `usr/etc` remains a soft error; done means the install path rejects images with the other fatal lint conditions.

索引モデルが issue の本文から書いたものです。