test: update unit tests to match podman-in-nested-containers-layer change

- Replace test_all_install_podman with test_none_install_podman: agent
  images intentionally no longer include podman; the nested-containers
  derived layer is where it lives (see build_image in nested_containers.py).
- Add podman to the package assertions in test_macos_nested_containers so
  its presence in the derived Dockerfile is explicitly verified.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/test_builtin_agent_images.py

@@ -21,10 +21,12 @@ class TestBuiltinAgentImages(unittest.TestCase):
                     r"(?m)^FROM node:22-trixie-slim\s*$",
                 )
 
-    def test_all_install_podman(self):
+    def test_none_install_podman(self):
+        # podman lives in the nested-containers derived layer (nested_containers.py),
+        # not in the base agent images, so bottles without the flag pay no cost.
         for dockerfile in _AGENT_DOCKERFILES:
             with self.subTest(provider=dockerfile.parent.name):
-                self.assertRegex(
+                self.assertNotRegex(
                     dockerfile.read_text(),
                     re.compile(r"(?m)^\s*podman(?:\s|\\|$)"),
                 )

tests/unit/test_macos_nested_containers.py

@@ -108,7 +108,7 @@ class TestNestedContainersImage(unittest.TestCase):
             calls.append((image, context, dockerfile))
             text = Path(dockerfile).read_text(encoding="utf-8")
             self.assertIn("FROM agent:base", text)
-            self.assertIn("aardvark-dns fuse-overlayfs netavark nftables passt", text)
+            self.assertIn("aardvark-dns fuse-overlayfs netavark nftables passt podman", text)
             self.assertIn("USER node", text)
             self.assertTrue((Path(context) / "nested-containers-init.sh").is_file())
 
@@ -128,7 +128,7 @@ class TestNestedContainersImage(unittest.TestCase):
             seen.append(Path(dockerfile).read_text(encoding="utf-8"))
 
         nested_containers.build_image("agent:base", build)
-        for package in ("passt", "nftables", "aardvark-dns"):
+        for package in ("podman", "passt", "nftables", "aardvark-dns"):
             self.assertIn(package, seen[0])
 
     def test_strips_subordinate_ranges_so_podman_avoids_newuidmap(self) -> None: