fix(macos): shorten the podman runtime dir to fit sun_path

podman derives conmon's attach socket as
`$XDG_RUNTIME_DIR/libpod/tmp/socket/<64-hex-id>/attach`. With the
descriptive `/tmp/bot-bottle-podman-run` that path is 116 bytes, past
the 108-byte sun_path limit, so every attached `docker run` failed with
"unable to upgrade to tcp, received 500" — while image pulls and the
service itself worked, which is what made it look like a compat-API bug
rather than a path-length one.

Found on the macOS host: quay.io pulled fine and then no container
could be started. Test pins the budget so a more readable name cannot
silently reintroduce it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_macos_nested_containers.py

@@ -142,11 +142,20 @@ class TestGuestEnvironment(unittest.TestCase):
 
     def test_enabled_bottle_uses_only_the_guest_local_socket(self) -> None:
         env = nested_containers.guest_env(True)
-        self.assertEqual(
-            "unix:///tmp/bot-bottle-podman-run/podman.sock", env["DOCKER_HOST"],
-        )
+        self.assertEqual("unix:///tmp/bbp/podman.sock", env["DOCKER_HOST"])
         self.assertNotIn("/var/run/docker.sock", " ".join(env.values()))
 
+    def test_runtime_dir_leaves_room_for_conmons_attach_socket(self) -> None:
+        """podman builds `$XDG_RUNTIME_DIR/libpod/tmp/socket/<64-hex>/attach`,
+        which must fit in sun_path (108 bytes). A descriptive runtime dir blew
+        past it and every attached `docker run` failed with "unable to upgrade
+        to tcp, received 500" while pulls and detached runs looked fine."""
+        attach = (
+            nested_containers.guest_env(True)["XDG_RUNTIME_DIR"]
+            + "/libpod/tmp/socket/" + "a" * 64 + "/attach"
+        )
+        self.assertLessEqual(len(attach), 107, attach)
+
     def test_macos_backend_declares_support(self) -> None:
         from bot_bottle.backend.macos_container.backend import (
             MacosContainerBottleBackend,