multipass alias/prefer won't work in a lxc container (nested kvm)

**Describe the bug**
Alias operations fail with the following error:

```bash
ubuntu@multipass-cli-test:~/snap/multipass/15347/config$ multipass prefer bar
Error saving aliases dictionary: Could not commit transactional file; filename: /home/ubuntu/snap/multipass/15347/config/multipass/multipass_aliases.json
```

This is a container-specific error.

**To Reproduce**
How, and what happened?
1. `lxc launch ubuntu:noble test-container --profile=default --profile=nested-kvm`
2. `lxc shell test-container`
3. `snap install multipass`
4. `sudo su ubuntu`
5. `multipass prefer foo`

**Expected behavior**
What did you expect to happen?

No errors.

**Additional context**

The AppArmor seems to be the culprit:

```
[51581.042429] audit: type=1400 audit(1755119445.915:11138): apparmor="DENIED" operation="link" class="file" namespace="root//lxd-multipass-cli-test_" profile="snap.multipass.multipass" name="/home/ubuntu/snap/multipass/15347/config/multipass/multipass_aliases.json" pid=1600581 comm="multipass" requested_mask="l" denied_mask="l" fsuid=1001000 ouid=1000 target="/home/ubuntu/snap/multipass/15347/config/multipass/#83962"

```
nested-kvm profile:

```
name: nested-kvm
description: Allow nested virtualization with /dev/kvm and vhost devices
config:
security.nesting: "true"
security.syscalls.intercept.mknod: "true"
security.syscalls.intercept.setxattr: "true"
devices:
kvm:
path: /dev/kvm
type: unix-char
vhost-net:
path: /dev/vhost-net
type: unix-char
vhost-vsock:
path: /dev/vhost-vsock
type: unix-char
used_by:
- /1.0/instances/multipass-cli-test
project: default

```

Start by reproducing `multipass prefer foo` inside the reported LXC `nested-kvm` container and inspect the failure involving `multipass_aliases.json`. Compare the AppArmor denial for the `snap.multipass.multipass` profile with a working environment; done means alias preference saves successfully without the transactional-file error.

Written by the indexing model from the issue text.