Prepare first-release qualification and native architecture CI

[joey-huckabee]

Summary

• add first-release security, operations, roadmap, and qualification documentation
• derive rootless storage paths from effective ClickHouse configuration
• qualify AMD64 and ARM64 images on native GitHub-hosted runners
• verify both architectures in release manifests
• make Podman the primary user runtime and document the tested 5.3 support baseline
• correct rootless Podman bind-mount and TLS key ownership procedures

Validation

• pre-commit run --all-files --show-diff-on-failure
• configured-path tests inside the built container
• Podman hardened quick start, health readiness, and authenticated query
• native CI run 34127310487: AMD64, ARM64, aggregate image, lint, and CodeQL passed

Evidence

• docs/QUALIFICATION.md records per-architecture jobs, package counts, scanner results, smoke results, and artifacts