Add experimental Containerfile.hi for Red Hat Hardened Images (#8)

* Add experimental Containerfile.hi for Red Hat Hardened Images

Single Containerfile with a shared builder stage and two --target
runtime stages (runtime-openshell, runtime-openclaw-only), both on
registry.access.redhat.com/hi/nodejs instead of RHEL 10.2 / UBI.

Motivation is build simplification and fixing the SQLite version
problem (hi/nodejs ships 3.53.4, avoiding the WAL-corruption bug in
UBI10's bundled Node that today requires a separate node-runtime
binary-swap stage), not CVE count. Not wired into CI; kept alongside
csb/Containerfile and csb/Containerfile.openclaw for comparison.

Both targets built and smoke-tested locally with podman: openclaw,
openshell, and gog CLIs all report correct versions, and the
non-root sandbox users, HOME override, and OpenShell policy files
are in place.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Pavel Anni <panni@redhat.com>

* Fix OpenShell node symlink, npm removal, and dnf cleanup in Containerfile.hi

Addresses external review of PR #8:

- runtime-openshell: /usr/bin/node ships as a symlink to node-24 in
  hi/nodejs. OpenShell's per-binary network policy (csb/policy.yaml)
  identifies the calling binary via /proc/<pid>/exe, which the kernel
  resolves to the real file, not the symlink used to invoke it -- so
  matching against the policy's literal "/usr/bin/node" path was
  unverified. Replace the symlink with a real file to get the same
  unambiguous guarantee csb/Containerfile already has.

- runtime-openshell: hi/nodejs bundles npm and its vendored deps
  (including a tar CVE), which the OpenShell CLI plugin never
  invokes. Remove it via dnf, matching runtime-openclaw-only's
  existing rationale.

- runtime-openclaw-only: add missing rm -rf /var/cache/dnf after the
  tar/gzip install, for consistency with every other dnf install
  step in the file.

- Header build example now includes --build-arg
  OPENCLAW_EXTENSIONS=openshell for the runtime-openshell target,
  matching the extension-selection comment further down the file.

Rebuilt and re-verified runtime-openshell: node is a real file,
npm is gone, openshell/gog/openclaw/node all report correct
versions, non-root sandbox user intact.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Pavel Anni <panni@redhat.com>

---------

Signed-off-by: Pavel Anni <panni@redhat.com>

Author: pavelanni