test(oci): cover image USER and policy identity resolution in the oci-image suite #4431

Summary

Add two image identity scenarios to the shared oci-image feature suite (tests/suites/features/oci-image) so the identity contract discussed in #4030 is pinned on both Docker and Podman. Requested in #3931 (comment) and deferred as a non-blocking follow-up to #3931.

Scenarios

1. No image USER and no policy identity: the workload runs as UID/GID 1000:1000.
2. Explicit USER root with a valid non-root policy user/group override: the workload runs as the policy-selected identity. Use a workspace that identity can write, so the test checks identity resolution independently of workspace permissions.

Each case should run on the existing Docker rootful, Podman rootful, and Podman rootless oci-image lanes.

Scope

• These assertions cover current behavior and do not need to wait for the bug: sandbox from a USER root image fails with an unexplained "UID or GID zero" error #4030 diagnostic changes.
• Moved to fix(podman): report IdentityResolutionFailed for rejected workload identities #4556: the scenario where an explicit USER root with no policy identity fails with IdentityResolutionFailed before the workload command runs. Podman doesn't report that reason today, so the scenario needs a driver change first.
• Detailed rejection provenance belongs in resolver unit tests.
• Checking that an interactive failure is printed once needs a real PTY test, which belongs with the bug: sandbox from a USER root image fails with an unexplained "UID or GID zero" error #4030 fix.
• If test(conformance): move scenario files into Cargo tests #4120 has moved the suite to e2e/suites/features/oci-image by then, add the scenarios there.

Current driver behavior

Both scenarios are test-only. Both drivers' unit tests already cover the expected behavior, for example identity_uses_numeric_default_for_userless_image in the Podman driver.