feat(runner): add podman session lifecycle

[pentaxis93]

Summary

• add a Podman-backed agentd-runner session contract for ephemeral container creation, in-container repository bootstrap, runa run execution, optional timeout enforcement, and guaranteed teardown
• add live integration coverage that exercises success, non-timeout failure, and explicit-timeout cleanup against real Podman containers
• update architecture and changelog documentation to describe the actual ephemeral container model and caller-resolved credential boundary

Changes

• add SessionSpec, SessionInvocation, SessionOutcome, RunnerError, and run_session() to agentd-runner
• create container startup logic that mounts methodology_dir read-only at manifest.toml, injects AGENT_NAME and resolved env vars, clones a clean repository workspace, writes runa agent config, and starts runa run
• add timeout-aware supervision and forced container removal on every exit path
• add end-to-end Podman tests using a fixture image and stub runa binary to verify success, failure, and timeout behavior
• update ARCHITECTURE.md and CHANGELOG.md so repository docs match the shipped runner behavior

Issue(s)

Closes #26

Test plan

• cargo fmt --all
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace -- --nocapture