fix(macos): shorten the podman runtime dir to fit sun_path

podman derives conmon's attach socket as
`$XDG_RUNTIME_DIR/libpod/tmp/socket/<64-hex-id>/attach`. With the
descriptive `/tmp/bot-bottle-podman-run` that path is 116 bytes, past
the 108-byte sun_path limit, so every attached `docker run` failed with
"unable to upgrade to tcp, received 500" — while image pulls and the
service itself worked, which is what made it look like a compat-API bug
rather than a path-length one.

Found on the macOS host: quay.io pulled fine and then no container
could be started. Test pins the budget so a more readable name cannot
silently reintroduce it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/backend/macos_container/nested-containers-init.sh

@@ -32,7 +32,9 @@ for device in /dev/fuse /dev/net/tun; do
     }
 done
 
-export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/bot-bottle-podman-run}"
+# Short by necessity, not by accident: conmon's attach socket lives under
+# this directory and must fit in a 108-byte sun_path. See nested_containers.py.
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/bbp}"
 config="$HOME/.config/containers"
 mkdir -p "$XDG_RUNTIME_DIR" "$config"
 chmod 700 "$XDG_RUNTIME_DIR"

bot_bottle/backend/macos_container/nested_containers.py

@@ -38,7 +38,14 @@ from typing import Callable
 from ...log import die, info
 
 _INIT = "/usr/local/libexec/bot-bottle/nested-containers-init"
-_RUNTIME_DIR = "/tmp/bot-bottle-podman-run"
+# Deliberately cryptic and short. podman derives conmon's attach socket as
+# `$XDG_RUNTIME_DIR/libpod/tmp/socket/<64-hex-id>/attach`, and a Unix socket
+# path may not exceed 108 bytes (`sun_path`). The descriptive
+# `/tmp/bot-bottle-podman-run` produced a 116-byte path, so every attached
+# `docker run` failed with "unable to upgrade to tcp, received 500" while
+# detached runs and image pulls worked fine. Do not lengthen this for
+# readability — it buys 8 bytes of headroom over the limit.
+_RUNTIME_DIR = "/tmp/bbp"
 _SOCKET = f"{_RUNTIME_DIR}/podman.sock"
 _LOG = "/tmp/bot-bottle-nested-containers.log"
 IMAGE_SUFFIX = "-nested-containers"