feat: accept the long-form volumes type: image mount

[lesnik512]

Adds type: image as a fourth long-form volume type — mounting an image's rootfs at target, emitted as podman run --mount type=image,source=<ref>,target=<path>[,subpath=<abs>]. Closes the last podman-expressible long-form volume gap (the image deferred-parser item in deferred.md).

Design: planning/changes/2026-07-17.03-image-mount-type.md.

Measured behaviors (docker v5.1.2 + podman 6.0.1)

• source required — the image reference; podman refuses a sourceless image mount (must set source and destination), Docker allows it optional → a rule-two narrowing (like bind).
• read_only accepted but not emitted — image mounts are inherently read-only; podman rejects both readonly and rw options, so no ro is emitted (Docker accepts and ignores read_only).
• image: {subpath} must be absolute — podman requires an absolute image subpath (bin → "must be an absolute path"), unlike a volume subpath (relative, resolved against the volume root). A ${VAR} subpath is carved out. Volume subpath handling is unchanged.
• The image source is an image ref, not a path → no project_dir resolution; a mismatched sub-map is refused.

Verification

• 1401 tests @ 100% coverage; just lint-ci, just check-planning clean.
• Conformance: a type: image corpus doc is both-accept (dedicated assertion).
• Integration test passed on real podman 6.0.1 — an image's rootfs mounts into the container (test -e /img/bin/busybox).
• The final review measured each option against live podman and caught the relative-subpath false green (docker accepts, podman rejects at run time), fixed here as a rule-two narrowing.

🤖 Generated with Claude Code