fix(podman): restore rootless workload SIGTERM shutdown

[elezar]

Summary

Restore the capability the supervisor needs to deliver canonical SIGTERM shutdown to a non-root rootless Podman workload. Avoid blocking shutdown on a durable exit report once that signal is already being handled.

Related Issue

Fixes #2855

Changes

• Retain CAP_KILL for Podman workloads so the root supervisor can signal the sandbox user process group.
• Skip durable main-process exit reporting when shutdown was initiated by a signal.
• Document diagnosis for rootless Podman shutdowns that fall back to SIGKILL.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• Rootless Podman E2E validation with the fix completed without a stop-fallback warning.
• Control E2E without the fixes reported the expected 15-second SIGTERM fallback and exit status 137.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for 4f1d8c7. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[krishicks]

The only blocker for this I think is the README for the podman driver needs to be updated to account for KILL not being dropped.