Podman parity: promote from experimental to supported in 1.1

Tracking issue for promoting Podman support from **experimental** (1.0) to **fully supported** (1.1).

Trait-level Podman integration is already implemented in `crates/core/src/runtime.rs` (`PodmanRuntime`, `ContainerRuntimeImpl::Podman`) and works for the happy path. What's missing for first-class support:

> **Status (2026-06-14):** Podman is now **supported** for 1.1. The required `Test (Podman)` lane landed in #237 (parity burn-down, 27→0) and the rootless/SELinux/userns + GPU + docs polish landed in #238. Remaining open items below are non-blocking refinements (extra local smoke tests, socket auto-discovery, example verification). The one functional gap is GPU passthrough on podman. Windows + podman e2e is tracked separately in #239.

## Parity items

- [x] **SELinux mount option**: emit `label=disable` for rootless Podman bind mounts (per upstream [PR #1045](https://github.com/devcontainers/cli/pull/1045), v0.80.0). ✅ #238 — implemented as a single `--security-opt label=disable` for podman on Linux (matching upstream `getPodmanArgs` in `singleContainer.ts`), not a per-mount option.
- [x] **`--userns=keep-id` handling**: include for non-root users in rootless mode; omit for root user (per upstream [PR #1018](https://github.com/devcontainers/cli/pull/1018), v0.77.0). ✅ #238.
- [x] **`--uidmap`/`--gidmap` rules**: must not conflict with `--userns` (per upstream [PRs #1005](https://github.com/devcontainers/cli/pull/1005) / [#1018](https://github.com/devcontainers/cli/pull/1018), v0.77.0). ✅ #238 — `--userns=keep-id` is suppressed when the user supplies their own `--uidmap`/`--gidmap` in `runArgs`.
- [ ] **Rootless Docker / Podman socket auto-discovery**: parity with upstream's rootless detection. _(Likely N/A for deacon's architecture — it drives the podman CLI directly, not the socket/API. Leave open pending confirmation.)_
- [x] **Resolve unqualified image refs for local images** (empirically the primary `up` blocker — see [findings comment](https://github.com/get2knowio/deacon/issues/30#issuecomment-4699902192)): podman requires fully-qualified names, so `podman create ` for a locally-built image tries to *pull* instead of using `localhost/`. Qualify/resolve local-first in `PodmanRuntime` (also fixes local image-metadata `inspect`). ✅ #237.
- [x] **Podman-aware GPU/runtime `info` query**: `docker info --format '{{.Runtimes}}…'` errors on podman's `info` schema (`can't eval field .Runtimes`). Use a podman-compatible query or skip gracefully (currently a noisy non-fatal WARN). ✅ #238 — short-circuits to a clean "unavailable" under podman (no WARN). CDI/`--device` GPU passthrough for podman remains a follow-up.

## Test coverage

- [x] Experimental, non-blocking CI lane running the `mvp-integration` suite against rootless podman with `DEACON_CONTAINER_RUNTIME=podman` (#236). First run: 136/163 passing; surfaces the parity gaps above. Promote to a required lane once green. ✅ Promoted to **required** in #237 (163/163).
- [ ] Add Podman-specific smoke tests gated by `which podman` (mirror of `smoke_up_*` / `smoke_exec` patterns). _(The required lane runs the full smoke/integration suite under podman; dedicated `which podman`-gated local smoke tests are still a nice-to-have for non-CI dev.)_
- [ ] Add Podman integration tests to a `docker-shared` or new `podman-shared` nextest group.
- [ ] Verify `--runtime podman` works against examples/up/ and examples/exec/.

## Docs

- [x] Once parity items are green and tests are stable, remove the "experimental" markers (✅ #238):
- README.md "Currently Unsupported" table row
- README.md "Runtime Selection" section
- CLAUDE.md "Container Runtimes" section
- `crates/deacon/src/cli.rs` `RuntimeOption::Podman` doc comment + `--runtime` help text
- One-time WARN in `crates/core/src/runtime.rs` (`warn_podman_experimental_once`)
- [x] CHANGELOG entry under 1.1. ✅ #238.

## References

- Upstream parity audit: `docs/ROADMAP_TO_1.0.md` §3.D (Podman parity)
- Filed alongside 1.0 PR-7 (Podman experimental status + CHANGELOG bootstrap)
- Empirical parity findings + experimental CI lane: #236 and the [findings comment](https://github.com/get2knowio/deacon/issues/30#issuecomment-4699902192)
- Burn-down → required lane: #237 · 1.1 polish: #238 · Windows + podman e2e spike: #239