feat(manifest): add allow-listed per-netns sysctls primitive

Routing apps (a rootless VPN exit) need packet forwarding in their own
network namespace, but /proc/sys is read-only inside a rootless
container, so it can only be set at create time. Add `app.sysctls`,
allow-listed to net.ipv4.ip_forward / net.ipv6.conf.all.forwarding with
values "0"/"1", and rejected under host networking where it would change
the host. Rendered on all three create paths: podman CLI --sysctl, the
libpod spec `sysctl` map, and Quadlet `Sysctl=`. Absent by default and
not serialized when empty, so existing manifests and units are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/quadlet-compilation.md

@@ -43,6 +43,8 @@ PublishPort=<bind>:<host>:<container>/<proto>
 Environment=<KEY>=<value>          # non-secret env only
 Secret=<secret_name>,type=env,target=<KEY>   # secrets by REFERENCE, never value
 Volume=<source>:<target><opts>
+AddDevice=<path>                   # manifest devices
+Sysctl=<key>=<value>               # manifest sysctls (own netns, allow-listed)
 ReadOnly=true                      # when security.readonly_root
 NoNewPrivileges=true               # when security.no_new_privileges
 HealthCmd=<cmd>                    # from the health_check block