fix(macos): install podman 5's full networking stack

netavark shells out to `nft` for the bridge network every compose file
expects, and aardvark-dns serves name resolution inside nested
containers. Neither arrives with the base image's
`--no-install-recommends` podman, and each fails at a different and
misleading layer: without nft containers are created but never start;
without aardvark-dns DNS inside a container fails while the engine, the
pulls, and the bridge all look healthy. That last one is the likeliest
explanation for the "DNS inside nested containers fails entirely" note
in #392 — a missing package, not a design gap.

Verified on the macOS host: with passt alone, `docker run` reached
netavark and died on "unable to execute nft".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/macos_container/nested-containers-init.sh

@@ -7,10 +7,12 @@ if [ "$uid" -eq 0 ]; then
     exit 1
 fi
 
-# pasta is podman 5's default rootless network helper. Checked here so a
-# missing package fails the bootstrap with a clear message rather than
-# letting every later `docker run` die with "could not find pasta".
-for command in podman docker fuse-overlayfs pasta slirp4netns; do
+# Every piece of podman 5's networking stack is checked here, because each
+# one fails at a different and misleading layer if it is absent: no pasta and
+# nothing starts at all; no nft and netavark cannot build the bridge every
+# compose file expects; no aardvark-dns and DNS inside nested containers fails
+# while everything else looks healthy.
+for command in podman docker fuse-overlayfs pasta nft slirp4netns; do
     command -v "$command" >/dev/null 2>&1 || {
         echo "missing nested-container prerequisite: $command" >&2
         exit 1

bot_bottle/backend/macos_container/nested_containers.py

@@ -82,12 +82,21 @@ def build_image(
             "COPY --from=docker_cli /usr/local/libexec/docker/cli-plugins/"
             "docker-compose /usr/local/libexec/docker/cli-plugins/docker-compose\n"
             "RUN apt-get update \\\n"
-            # passt provides `pasta`, which podman 5 uses by default for
-            # rootless networking (podman 4 defaulted to slirp4netns). Without
-            # it every container fails to start with "could not find pasta".
-            # slirp4netns stays as the documented fallback.
+            # podman 5's networking stack, installed explicitly because the
+            # base image's `--no-install-recommends` podman does not pull it
+            # in and each piece fails at a different, misleading layer:
+            #   passt        -> `pasta`, the default rootless netns helper
+            #                   (podman 4 used slirp4netns); without it
+            #                   nothing starts: "could not find pasta"
+            #   nftables     -> `nft`, which netavark shells out to for the
+            #                   bridge network every compose file expects
+            #   aardvark-dns -> name resolution *inside* nested containers;
+            #                   without it DNS fails while everything else
+            #                   looks healthy
+            # slirp4netns stays as the documented fallback for pasta.
             " && apt-get install -y --no-install-recommends "
-            "fuse-overlayfs passt slirp4netns uidmap \\\n"
+            "aardvark-dns fuse-overlayfs netavark nftables passt "
+            "slirp4netns uidmap \\\n"
             " && rm -rf /var/lib/apt/lists/* \\\n"
             # Deliberate: an empty subordinate range keeps podman on the
             # single-UID mapping that needs no CAP_SYS_ADMIN.  Adding ranges