Add container clean (reclaim disk space) for container 1.4.1

[kylemclaren]

Summary

Apple container 1.4.1 added container clean, a one-shot trim of freed blocks on a running container's root filesystem and named volume mounts so the host reclaims space from the sparse rootfs.ext4 / volume.img files (apple/container#1949, #2228). Nothing is deleted, and the CLI skips read-only roots and ro mounts.

This wires it into the app:

• Service: ContainerService.clean(ids:) / cleanArguments(ids:).
• Containers screen: "Clean" in the row's context and ellipsis menus (running containers only) and a "Clean" pill in the inspector header next to Console. The row's busy spinner and the error banner give feedback.
• ⌘K palette: "Clean " for each running container, routed through the Containers screen rather than run globally so failures are visible.
• System screen: "Clean running containers" in the Reclaim space row, with a confirmation explaining what it does. Disabled when nothing is running.
• Older CLIs: a pre-1.4.1 container rejects the unknown subcommand with a usage error; the UI shows "Cleaning containers requires Apple container 1.4.1 or later" instead of the parser text.
• README feature table updated.

Test plan

• xcodebuild build (app target) succeeds
• xcodebuild test: 144 tests in 19 suites pass, including new containerClean, cleanSendsIDsAndReturnsCleanedList, and cleanOnOlderCLIExplainsVersionRequirement
• Live check against container 1.4.1 with a throwaway alpine:3.21 container:
  • running container: prints the id, exit 0
  • one valid + one bogus id: cleans the valid one, prints one notFound error line, exit 1 (so the bulk System-screen action reports partial failures as an error, with the failing id named)
  • duplicate ids: deduplicated by the CLI, exit 0
  • missing/stopped container: internalError: "failed to clean container" (cause: "notFound: …"), which the existing classifier maps to .notFound