feat(patch_container_image): add live bind-mount patching

[pablomh]

Summary

• add a live-patching companion script that extracts runtime trees from the base image, applies PR or diff inputs locally, and mounts the result back into quadlet-managed containers
• fail hard on patch errors and gem dependency changes so image-rebuild-only changes still route through the build workflow
• print the exact drop-in contents and rollback commands needed to apply or revert the patch safely

Test plan

• python3 -m py_compile scripts/build_patched_container_image.py scripts/patch_container_image.py
• Upstream baseline dry-run for --pr theforeman/foreman:10942 emits a build Containerfile
• python3 scripts/patch_container_image.py --dry-run --pr theforeman/foreman:10942 --container-unit foreman --tag satperf-pr2-smoke --patch-root /tmp/satperf-live-patches
• Dry-run prints the generated manifest and quadlet Volume= drop-in instead of requiring an image rebuild

Made with Cursor