feat(macos): choose and document a supported container runtime #4359

Follow-up to #3934.

Current gap

The original macOS plan explicitly called for a macOS container runtime. At 4b480993994d102cec9603404950201fbbdc597e, the bootstrap installs Linux Docker Engine packages under the Linux path, but there is no macOS runtime selection or setup documentation. Installing shared development tools does not provide a running container engine on macOS.

Acceptance criteria

• Choose the supported macOS runtime and decide whether installation belongs in the shared profile, personal profile, or documented opt-in setup.
• Document installation, startup, the Docker CLI/context used, and any unavoidable first-run interaction.
• Implement the chosen configuration without carrying Linux Docker groups, systemd, or APT hooks onto macOS.
• Verify a disposable container and a small Compose workload, plus behavior after restarting the runtime and rerunning setup.
• Preserve any existing user-selected runtime/context unless an explicit migration is requested.