Add container clean with mount namespace trimming

[recrack]

Important

This draft builds on #1949 by @saehejkang. The original commits and authorship are preserved. It remains a draft until apple/containerization#830 is agreed, the dependency revision is updated, and the allocated-size integration assertions are finalized.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Motivation and Context

Add container clean to trim unused blocks from a running container's root filesystem and named block volumes without recreating the container.

Named volumes are mounted in the workload container's mount namespace, not vminitd's namespace. The companion apple/containerization#830 carries the workload container ID through filesystem-operation RPCs, pins the init process root to avoid PID-reuse races, and resolves canonical container paths with openat2(RESOLVE_IN_ROOT | RESOLVE_NO_MAGICLINKS).

This draft updates #1949 to the current main, resolves its API and test-fixture conflicts, adds runtime identity validation, and expands the integration coverage. It is an alternative continuation of the existing work rather than an unrelated implementation. Maintainers and the original author can choose whether to continue here or fold these commits back into #1949.

Closes #1763.

Changes

• Add the container clean CLI and API/runtime routes
• Reject stopped containers and mismatched runtime identifiers
• Trim the root filesystem and writable block mounts
• Cover stopped containers, multiple running containers, rootfs reclaim, and named-volume reclaim
• Measure host allocated blocks rather than sparse-image logical size

Testing

• Tested locally
• Added/updated tests
• Added/updated docs

Commands and results

• make fmt
• swift build -Xswiftc -warnings-as-errors --build-tests
• make container
• Isolated local integration using a dedicated app root and locally built vminit:latest
  • stopped-container rejection passed
  • cleaning multiple running containers passed
  • root filesystem and named-volume trim RPCs completed without errors
  • host allocated-size assertions are still being stabilized; the current polling and diagnostics are retained in this draft for review

Dependency

This PR should remain a draft until apple/containerization#830 is merged and the package dependency is updated to its merged revision.