test(oci): move OCI image USER/WORKDIR checks into a shared tmachine feature suite #4346

User Story

I need image USER and WORKDIR regression coverage that runs the same way on every container runtime, so a Podman regression is caught as reliably as a Docker one.

Description

Move the OCI image identity and workspace tests out of the legacy Rust e2e test (e2e/rust/tests/custom_image.rs) and into a new oci-image feature suite under tests/suites/features. The suite runs through the installed OpenShell CLI on tmachine, on Docker rootful, Podman rootful, and Podman rootless.

Today these checks only run against Docker, through a wrapper-managed gateway instead of an installed package. They cannot catch a Podman regression, and they do not exercise the packaged CLI and gateway that users install.

Context

• Docker/Podman slice of test(e2e): add cross-driver image-to-sandbox conformance #2422 (cross-driver image-to-sandbox conformance), tracked under test: define and track OpenShell testing strategy #3954. VM, Kubernetes, and OpenShift coverage remains in test(e2e): add cross-driver image-to-sandbox conformance #2422.
• Related to test(podman): run existing Podman behavioral e2e coverage in CI #3712. podman_oci_identity remains outside the tmachine lanes, so this issue does not close that part of test(podman): run existing Podman behavioral e2e coverage in CI #3712.
• Split from feat(podman): honor OCI image working directories #3801. Builds on refactor(sandbox): remove unreachable root-side identity and workspace code #3979, fix(podman): create managed workspace volumes owned by the workload identity #3981, and feat(podman): honor OCI image working directories #3982 (Podman OCI WORKDIR, which closed feat: honor OCI WorkingDir for Docker and Podman workspaces #2526).
• Implemented in fix(oci): report workspace rejections and share OCI USER and WORKDIR checks across Docker and Podman #3931.
• ARM64 coverage runs the same suite through the existing ARM64 Docker e2e workflow until tmachine supports ARM64.
• Podman-specific checks with no shared equivalent (pinned image ID, container isolation) stay in e2e/rust/tests/podman_oci_identity.rs.

Definition of Done

• An oci-image feature suite covers image USER and WORKDIR handling: custom workdirs with named and numeric users, the default managed workspace, rejection of an unwritable workdir, and file transfer into the workspace.
• The suite runs in branch, release-dev, and release-tag CI on Docker rootful (DEB), Podman rootful (RPM), and Podman rootless (RPM) tmachine lanes.
• ARM64 Docker coverage is preserved.
• The legacy custom_image Rust e2e test, its Cargo target, and helpers used only by it are removed.
• TESTING.md explains how to run the suite.