Avoid inode-loop detection in tfork socket cleanup

[shengqi-gensee]

Summary

Replace tfork's external GNU find socket cleanup with Go's path-based
filepath.WalkDir.

OverlayFS can expose unrelated directories with the same device and inode.
GNU find interprets that collision as a filesystem loop, skips the affected
subtree, and leaves stale Unix sockets behind. WalkDir follows directory
paths without following symlinks, removes socket entries, and continues after
individual traversal or removal failures.

Add a regression test covering a nested Unix socket, preservation of regular
files, and non-traversal of a symlink outside the root.

Test plan

• go test ./pkg/domain/infra/abi -run '^TestTforkPurgeSockets$' -count=1
  on the Phase 0 GCE VM with the custom kernel and build dependencies
• Rebuilt Podman 5.8.2 on the Phase 0 VM
• Ran the full two-copy tclone smoke test on Btrfs/OverlayFS:
  fork isolation, git merge, discard, and cleanup all passed
• Confirmed the previous GNU find filesystem-loop warning no longer appears

Local compilation was not used because the development host lacks the GPGME
and Btrfs development headers required by this Podman package.

[yiying-zhang]

The fix itself lgtm.

The new test covers the desired cleanup behavior, but not the actual OverlayFS inode-loop regression. A normal tempdir with a nested socket would also have worked with the old find -type s -delete implementation, so this is more of a semantic/unit test than a regression test for the reported root cause.