fix(drivers): normalize label namespace

[elezar]

Summary

Normalize driver-owned label keys on the repository's canonical openshell.ai/ namespace. This removes the remaining openshell.io/ labels from the Podman and VM drivers and keeps their selectors, fixtures, E2E helpers, and documentation aligned.

Related Issue

No issue required: this is a localized consistency fix for existing driver label keys.

Changes

• Changed Podman isolation-role labels and workload filters to openshell.ai/isolation-role
• Changed the VM extension label prefix to openshell.ai/extension.
• Updated Podman unit fixtures, E2E selectors, cleanup logic, and networking documentation
• Audited the repository and confirmed no openshell.io/ label keys remain

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (selectors updated; runtime E2E not required for the string-only change)
• cargo test -p openshell-driver-podman
• cargo test -p openshell-driver-vm lifecycle::tests

The full VM unit suite was also attempted. Its label-related lifecycle tests passed; seven unrelated tests could not complete because local e2fsprogs tools are unavailable or existing tracing fixtures timed out.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)