Add an initial varlink IPC interface

I'm thinking about bootc-dev/bootc#522
again, and varlink is definitely an option there.

In order for us to gain experience with it, I think it makes
sense to start here. In some experimentation, it seems zlink
is indeed better maintained than varlink-rs and more complete.
(there's some unreleased async support in varlink-rs, and
 the activation/service stuff was not complete).

In this initial pass, we first cover the `images` API (which is
really just a thin wrapper for enumerating images in the container
runtime store). The more interesting one is `io.bootc.vk.ephemeral`
which supports spawning.

Note: The workspace lint for unused_must_use is relaxed from forbid to deny
so that zlink's proc-macro-generated #[allow(unused)] does not conflict.
the practical enforcement is identical.

Also added docs/src/varlink.md with usage examples for all interfaces.

Assisted-by: OpenCode (claude-opus-4-6)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

Cargo.lock

@@ -18,7 +18,9 @@ xshell = "0.2.7"
 # Require an extra opt-in for unsafe
 unsafe_code = "deny"
 # Absolutely must handle errors
-unused_must_use = "forbid"
+# "deny" rather than "forbid" so that proc-macro expansions (e.g. zlink)
+# can locally #[allow(unused)] without conflicting.
+unused_must_use = "deny"
 missing_docs = "deny"
 missing_debug_implementations = "deny"
 # Feel free to comment this one out locally during development of a patch.