Make the packaged runner able to create a container on Debian and Ubuntu

Make the packaged runner able to create a container on Debian and Ubuntu

Three failures in a row stop a machine built exactly as docs/deploy/runner.md
says, and each one is a setting the distributions either get wrong or leave out:

- The unit sets NoNewPrivileges=true. Rootless podman, Docker, and nerdctl all
  map the caller into the container through setuid newuidmap and newgidmap, and
  that setting stops a setuid helper from gaining privilege, so the mapping
  fails before a container exists. Turn it off and say why: the isolation a job
  gets is its container, so the rest of the hardening stays.

- Debian and Ubuntu ship /etc/containers/registries.conf entirely commented out,
  so a digest-pinned base image written as a short name has no registry to
  resolve against. Install unqualified-search-registries = ["docker.io"] as a
  drop-in. The reference's digest is the pin; the list only says where to ask,
  and a site can override it with a higher-numbered file. Chosen over qualifying
  the repository's own .vole/images, because a contributor adding a workflow
  later hits the same wall on a machine they cannot edit.

- vole-runner runs as a system service, so the runner's account has no systemd
  user manager for podman to ask for a cgroup scope; crun falls back to sd-bus,
  which answers Interactive authentication required, and the first RUN step
  dies. Install [engine] cgroup_manager = "cgroupfs" as a drop-in, which writes
  into the subtree Delegate=yes already gives the service.

Both drop-ins merge with the distribution's configuration instead of replacing
it, and reach the runner's account because system configuration is read for
rootless users too. Every install path installs the package, so the cloud-init
template needs no second copy of either setting to drift.

docs/deploy/runner.md says what each file is for and what the failure looks like
without it, and names the user-unit-with-enable-linger arrangement as the
alternative an operator may choose, including the /run/user/<uid> conflict with
the unit's XDG_RUNTIME_DIR. scripts/check-deploy.py now fails when the package
stops installing either drop-in, or when the unit goes back to defeating the
uid mapping: a runner missing one takes a job and fails it before a step runs,
which reads on the instance as a repository whose build broke.

Closes 01M6YW9ZWB69GVFN7BR53SPWC6
Closes 01M6YWA3JX0WWHJ55JCVDZ2QTP
Closes 01M6YWA79EWR97YYK5NR7R19CK