Split out of a different PR, the Podman lifecycle improvements that are independent of the IBM cross-compile RBE enablement, so that PR can build on them.

1. 1. Changes

`buildscripts/prepare_podman_for_bazel.py` (+ `buildscripts/tests/test_prepare_podman_for_bazel.py`):

• Write a task-scoped `containers.conf` selecting `cgroupfs`, so rootless Podman never probes the unavailable systemd user session on Evergreen hosts.
• Discover host registry credentials (`REGISTRY_AUTH_FILE`, `XDG_RUNTIME_DIR`, `XDG_CONFIG_HOME`, `DOCKER_CONFIG`, `$HOME`) before the runtime directory is replaced, and forward only the path.
• Recover from stale pause/conmon failures (SIGABRT, "invalid internal status", leftover mounts) by unmounting only the task's private `overlay-containers` tree and retrying once.
• Bound every Podman/`loginctl` invocation with a timeout and emit bounded diagnostics instead of replaying Podman panic traces.
• New `--cleanup` entrypoint (`cleanup_podman_for_bazel`) that removes all task-owned Podman state during task teardown.

`bazel/toolchains/cc/mongo_linux/linux_container_action_wrapper.py` (+ test):

• Detect stale-runtime failures in `run`/`rm` and recover by resetting only the task-scoped storage, then retrying the exact deterministic container command once.
• Move the action temp tree from `output_base/mongo_linux_action_tmp` to a sibling of the output base so rootless Podman does not inherit the parent's read-only bind flag (container layout v5 -> v6 invalidates older containers).
• Surface mount-probe failure details and pass an explicit `podman_auth_file` through the trusted config.

`bazel/wrapper_hook/hermetic_container_integration.py` (+ test):

• Same cgroupfs and auth-file plumbing for the host container runtime selection.
• When `podman system migrate` fails on a task-scoped runtime, reset that runtime instead of failing the build.
• Keep image-pull diagnostics off Bazel's machine-readable stdout, and retry a pull anonymously when a stale host credential is rejected for public images.

Evergreen YAML:

• New "cleanup podman for bazel" function, wired into the teardown of the generic Bazel compile, test, coverage, run, and resmoke task functions; also prepare the task-scoped runtime before test-style invocations that lacked it.

1. 1. Safety

• All recovery and cleanup paths operate only on `MONGO_PODMAN_TASK_ID`-scoped storage; shared host Podman state is never touched.
• Teardown is best effort: cleanup failures are reported as warnings and never mask the build or test result.
• Tasks without a task id or without Podman selected are no-ops.

Anything in this description will be included in the commit message. Replace or delete this text
before merging. Add links to testing in the comments of the PR.