Add identifier validation tests for the disk-usage routes - #2136

…eme (#133)

Closes #129.

## What

Adopts apple/container **1.3.0** (and its required containerization
**0.41.0**).

### `RequestScheme.auto` removal
([apple/container#2100](apple/container#2100))

1.3.0 deletes `RequestScheme.auto` and the internal-host detection
behind it, so
`schemeFor` now returns `https` for every host unless the caller already
chose
`http`. Without the old heuristic a plain-HTTP registry on `localhost`
or a
private network is unreachable unless the user ticks "Allow insecure
registry".

New `RegistrySchemeResolver` ports that detection **verbatim** —
`localhost`, the
daemon's internal DNS domain, and the RFC 1918 / loopback IPv4 ranges
resolve to
`http`; everything else to `https` — and drives the paths where Berthly
controls
a single host: `resolveRegistryConnectionTarget` (login), `pullImage`,
`pushImage`, `recreateContainer`.

`runRegistryFlags` / `machineRegistryFlags` can't use it: their one
`Flags.Registry` scheme fans out to the init-image fetch too
(`Utility.containerConfigFromFlags`), so per-host detection isn't safe
there. The
insecure toggle keeps its "force http" meaning and becomes the only path
to
`http` for `run` / `machine create` against an untoggled internal
registry —
documented as a deliberate gap in `PARITY.md` (`pull` then `run` for the
same
result without the toggle).

The vminit base-image pull is hardcoded to `.https` (Apple's registry,
not routed
through the resolver so a user's internal DNS domain can't match it).

### containerization 0.41.0

Required by 1.3.0.
[apple/containerization#783](apple/containerization#783)
drops the redundant `v8` variant from arm64's `Platform.description`
(matching
Docker/containerd) — one test assertion updated. The `Platform` equality
fix
([#833](apple/containerization#833)) doesn't
affect
`builderPlatform` (line 2433 mirrors 1.3.0's own
`BuilderStart.swift:116`
verbatim).

### Compatibility floor

Stays at 1.2 — nothing in 1.3.0 adds an API Berthly newly calls, so a
1.2.x
daemon still works. Only the SPM pin moved.

## Test plan

- [x] `xcodebuild build` — succeeds
- [x] `xcodebuild build-for-testing` (all test targets incl.
UITests/E2E) — succeeds
- [x] `BerthlyTests` — 532 pass, 0 failures (new
`RegistrySchemeResolverTests`,
  `runRegistryFlagsDefaultToHTTPS`)
- [x] `swiftlint lint --strict` — 0 violations
- [ ] Not verified without a local daemon: disk-usage volume-name
validation
  ([#2107](apple/container#2107) /
[#2136](apple/container#2136)) on the
`fetchDiskUsage`
path — stricter input checks, Berthly passes real volume names, no
expected impact.

## Follow-ups (separate issues)

#130 tmpfs fix verification · #131 k8s PARITY.md rationale · #132 mock
kernel fixtures