macOS container runtime

macOS itself is a supported platform (the macos role, ansible_facts.os_family guards, and zsh sourcing), and the docker role already runs on macOS via colima (docker_macos_runtime: colima installs colima plus the docker CLI and docker compose). The open item is broadening that single runtime into a real choice.

The docker role installs docker.io on Linux/WSL and colima on macOS; colima is the only macOS runtime wired today. Make it a per-host choice (colima / Docker Desktop / podman / Apple container), with Apple's container (reached 1.0 in 2026-06, macOS 26+, free and open-source — no Docker Desktop licensing, one micro-VM per container) a first-class option on current macOS. Its CLI is container, not docker (OCI-compatible, so standard images work, but it needs docker-compatible aliases and a docker compose parity check). A host-runtime concern — not the Devcontainers payload item, which is about what runs inside a container regardless of runtime.