api: image_status has no 'unknown' member — an unanswerable podman-seam read is indistinguishable from a genuinely missing image

[thinmintdev]

Follow-up from #1889 / PR #1937 (open question 1).

ContainerProvider.image_present returns a bool and the image_status payload enumerates present/missing only. When the rootful seam is unanswerable as the hal0 service user (rc 66 operational failure, missing grant, wrapper drift), the API now logs hal0.podman_ro.image_present_unanswered at WARNING but still reports missing — an authoritative-looking answer for an unanswered question. That shape (green/definitive surfaces over an undiagnosable state) is the same failure family as #1888's health surfaces and #1465's seam inventory.

Fix is an API-schema change: add an unknown member (or tri-state) to image_status and propagate the seam's tri-state result. Deliberately out of #1937's scope. Worth deciding before GA whether the schema change rides 1.0 or 1.0.x.

Refs #1889.

[thinmintdev]

PR #1937's security review adds a concrete half of this: _seam_read collapses wrapper rc 64/65/66 to None, so an operational podman failure (rc 66) on the service account still surfaces as image_status: "missing" — the wrapper's carefully-built exit-code contract never reaches the API. When adding the unknown member, map rc 66 (and missing-grant/wrapper-drift) to it so the tri-state is end-to-end rather than decorative. Review: #1937 (comment)