fix: remove workspaces containing root-owned container files

[eshulman2]

Summary

Workspace cleanup currently uses shutil.rmtree, which can fail when containers leave root-owned files behind. Use podman unshare rm -rf when Podman is available so cleanup runs in the same user namespace that owns those files.

If Podman is unavailable, exits unsuccessfully, or cannot be started, cleanup falls back to shutil.rmtree.

This change was extracted from #44 so the workspace-removal fix can be reviewed and merged independently from .forge/ artifact persistence.

Changes

• Resolve Podman from PATH before cleanup
• Remove the workspace through podman unshare rm -rf
• Fall back to shutil.rmtree for unavailable or failed Podman execution
• Preserve workspace registry and active-state cleanup behavior
• Add focused coverage for success and each fallback path

Test plan

• uv run ruff format --check src/
• uv run ruff check src/
• uv run pytest tests/unit/workspace/test_manager_cleanup.py (5 passed)