refactor(vm): separate rootfs materialization

[elezar]

Summary

Separate the VM driver's existing image acquisition and ext4 rootfs materialization concerns, then make Docker and Podman explicit local image-source variants. This provides a concrete VM-driver boundary for future provisioning work without changing current image-selection behavior.

Related Issue

Related to #2255

Changes

• Add VM-local UnpackedImage, RootfsMaterializationRequest, VmRootfsImage, and VmRootfsMaterializer types.
• Route both existing local-container and registry rootfs cache paths through the materializer.
• Preserve Docker-first, Podman-fallback selection while reporting Docker and Podman as distinct local image sources.
• Update compute-runtime architecture documentation.

Testing

• mise run pre-commit passes (intentionally deferred)
• Unit tests added/updated: cargo test -p openshell-driver-vm --lib (121 passed)
• E2E tests added/updated (not applicable to this refactor)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/2388 is at {"messa while the PR head is 5832a22. A maintainer needs to comment /ok to test 5832a22df06fadb259a1e790798bf2d6e80ecde8 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.