Disk quotas and multi-arch image resolution

cardinal run --disk adds per-container disk limits; images resolve the right architecture.

Two refinements in 1.14:

  • --disk — a human-readable disk limit (10G, 512m) enforced with loop

device quotas, so a runaway container can't fill the host filesystem.

  • Multi-arch image resolution — when the image advertises several

architectures, cardinal picks the one matching your host.

The overlay mount ordering was also fixed so the disk limit applies to the

correct merged directory.