perf(async): remove blocking std::process::Command from async paths

Every production process spawn reachable from a tokio worker now uses
tokio::process: the install path's podman-port probe, the dependencies
disk check, factory-reset restart, config host-IP detection, the
orchestrator's host-facts helpers (resolve_dynamic_env and its call
sites made async to carry it through), and AutoRuntime's podman/docker
probes.

The FIPS transport probe is the special case: is_available() is a sync
trait method called from async route(), so instead of blocking ~50ms
on systemctl per stale-cache hit it now serves the cached value and
refreshes on a background thread (stale-while-revalidate) — bounded
staleness, zero stalled workers.

§C of the 1.8.0 hardening plan; container/transport/config/package
suites green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/container/src/runtime.rs

@@ -853,11 +853,11 @@ pub struct AutoRuntime {
 impl AutoRuntime {
     pub async fn new(user: String) -> Result<Self> {
         // Try Podman first
-        if Self::check_podman_available() {
+        if Self::check_podman_available().await {
             Ok(Self {
                 runtime: Box::new(PodmanRuntime::new(user)),
             })
-        } else if Self::check_docker_available() {
+        } else if Self::check_docker_available().await {
             Ok(Self {
                 runtime: Box::new(DockerRuntime::new(user)),
             })
@@ -866,12 +866,20 @@ impl AutoRuntime {
         }
     }
 
-    fn check_podman_available() -> bool {
-        Command::new("podman").arg("--version").output().is_ok()
+    async fn check_podman_available() -> bool {
+        TokioCommand::new("podman")
+            .arg("--version")
+            .output()
+            .await
+            .is_ok()
     }
 
-    fn check_docker_available() -> bool {
-        Command::new("docker").arg("--version").output().is_ok()
+    async fn check_docker_available() -> bool {
+        TokioCommand::new("docker")
+            .arg("--version")
+            .output()
+            .await
+            .is_ok()
     }
 }