feat: add Apple Container execution engine

[pchalamet]

Terrabuild can now run image-backed operations with Apple Container using --engine apple, engine = ~apple in WORKSPACE, or Apple in the Graph UI. The backend uses the container CLI on Apple silicon with macOS 26 or later and checks that the runtime is available before execution.

The implementation preserves workspace precedence and host execution for operations without an image. It supports workspace/home/temp mounts, environment forwarding, CPU/platform options, and named-container cleanup after failures, cancellation, or an abandoned run. Docker remains the default. Apple uses its own image store and default networking; selecting it does not translate @docker commands or publish development-server ports.

Includes unit coverage, a dedicated make smoke-test-apple target, documentation, and an Unreleased changelog entry.

Validation completed:

• make test
• make self
• make smoke-tests, with no snapshot differences
• make try-docs
• make smoke-test-apple on macOS 27 with Apple Container 1.4.1 and OrbStack stopped, covering parallel builds, paths with spaces, environment forwarding, exit codes, and Ctrl+C cleanup

Docker-based checks used an explicit OrbStack DOCKER_HOST because the cache integration test isolates HOME. OrbStack was stopped again after validation.