Add Apple Container management layer

[Richie Gomez (richiemsft)]

📖 Description

Adds the typed management layer for the experimental Apple Container backend introduced by #957. The new macOS-scoped apple_container_common crate defines:

• bounded, shell-free CLI command/result/error abstractions with an injectable runner;
• Apple silicon/macOS 26 and exact CLI/apiserver 1.2.2 availability models;
• actionable missing-CLI diagnostics for /usr/local/bin/container;
• typed container/network names, ownership tokens, and verification labels;
• mount, environment, network, resource-limit, run, and cleanup plans.

This remains fail-closed: it does not execute Apple Container commands or create resources. Runtime dispatch is deferred to the next stacked PR.

🔗 References

• Stacked on Add Apple Container config surface #957

🔍 Validation

• cargo fmt --all -- --check
• cargo clippy -p apple_container_common --all-targets -- -D warnings
• cargo test -p apple_container_common
• cargo test -p mxc_engine apple_container
• cargo check -p mxc_engine

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (not applicable to this management-only increment)
• Updated Copilot instructions (deferred until the backend architecture is complete)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (pending CI)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHub
Actions build; it runs on merge to main, and Microsoft reviewers with write access can trigger it
on a PR with /azp run. See docs/pull-requests.md.

If the dependency-feed-check check fails on a new dependency, the crate must be added to
the feed before the PR can pass. See docs/pull-requests.md
for the steps.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.