fix(tfork): make live-clone cleanup transactional

[yiying-zhang]

Summary

• make live-clone setup an explicit transaction until publication commits;
• centralize idempotent rollback for source thaw, clone processes, cgroups,
  bundles, runtime publications, exit files, and partial registration;
• protect PID cleanup with /proc/<pid>/stat start-time identity;
• make network, migration, watcher, conmon, source-health, and clone-health
  failures fatal; a multi-copy batch now rolls back all copies if copy N fails;
• remove external-registration and /run/libpod/tfork lifecycle leaks;
• reject unsupported systemd-cgroup sources before freeze; and
• add fault injection at all eight Podman-owned publication boundaries.

Validation

• focused abi and libpod Go tests passed;
• Podman build passed;
• all eight injected fault boundaries were reached and rolled back cleanly;
• a clean fork immediately after faults passed inheritance and divergence;
• systemd-cgroup rejection left the source usable;
• final integrated run left zero bundles, runtime publications, helper
  processes, cgyard mounts, clone cgroups, and D-state tasks.

Compatibility

The current tfork manual cgroup plumbing is cgroupfs-specific. This change
fails early with an actionable error instead of freezing a systemd-cgroup
source and failing during restore.