Events, named volumes, and registry auth

1.18 rounds out the container lifecycle:

• cardinal events — stream real-time container lifecycle events

(--since <time> filters the backlog).

• Named volumes — volume create / ls / rm / inspect / prune for persistent

storage that outlives any single container.

• Export & import — save and load container images as tar.gz archives.
• Registry auth — cardinal login / cardinal logout plus cardinal push

for authenticated registries.

• Multi-arch resolution with --platform, and an experimental rootless mode

with --no-new-privs.

These are the pieces that make cardinal a real alternative for day-to-day

container work, not just a teaching tool.