fix(hardened): restore podman compatibility on linux-hardened

Two breakages observed on first linux-hardened boot:

1. `podman run` failed because linux-hardened sets
   kernel.unprivileged_userns_clone=0 by default (stock linux: 1).
   Rootless podman requires unprivileged user namespaces. Restoring
   the stock-kernel default via sysctl — this is a documented hardened
   knob meant to be flipped back if you actually use rootless
   containers. No-op on stock kernel.

2. "kernel does not support overlay fs: 'overlay' is not supported over
   btrfs". Kernel overlayfs cannot use a btrfs subvolume as lowerdir;
   podman needs fuse-overlayfs as the user-mode shim. ~10-30% slower
   I/O than native overlay but works correctly and is the upstream
   recommendation for btrfs-backed rootless storage.

0 files changed, 0 insertions, 0 deletions