perf(tfork): overlap socket purge with source capture

[yiying-zhang]

Summary

• emit a CRIU post-tfork-freeze action and expose a crun restore barrier;
• scan the first clone root while CRIU performs Phase A;
• record socket paths in a NUL-delimited manifest;
• apply that manifest to every clone root instead of recursively scanning each
  clone;
• keep restore blocked until purge completes;
• gate the path with PODMAN_TFORK_OVERLAP_SOCKET_PURGE=1.

Performance

Ten interleaved real-Webtop pairs, with source syncfs enabled in both arms:

Mode	Wall median	Mean
serialized recursive scan	0.845 s	0.847 s
overlapped scan	0.650 s	0.655 s
saving	0.195 s	0.192 s

Validation

• 20/20 real-Webtop forks passed inheritance and isolation checks;
• the prepared Webtop correctly produced an empty socket manifest;
• a synthetic owned Unix socket was found in the manifest and removed from
  every clone before restore;
• scan/manifest failure keeps the barrier closed and enters transactional
  rollback.