Vendor apple/containerization with a VM-extensions forwarding patch

Switch the containerization dependency from the github URL to a vendored copy
(third_party/containerization, upstream commit 6b7b42ca) referenced by path, so
we can carry a small local patch that upstream lacks: LinuxContainer.Configuration
gains a `vmExtensions` field forwarded into VMConfiguration.extensions. Upstream
already supports VMConfiguration.extensions + the VZInstanceExtension hook, but
LinuxContainer — our only entry point — never forwarded them, so there was no way
to attach a device (e.g. a memory balloon) to a container's VM.

Tests/, docs/, examples/, images/ and the corresponding test targets are trimmed
for footprint (we never build the dependency's tests). See PATCHES.md for the full
diff vs. upstream and the re-vendoring procedure. Also adds the ContainerizationExtras
product to NucleicCore (AddressAllocator, named in the configureVZ signature).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

scripts/pre-commit.fmt

@@ -0,0 +1,16 @@
+#! /bin/bash -e
+
+setup_error() {
+    echo failed to run: $1 1>&2
+    echo run '"make pre-commit"' and try again 1>&2
+    exit 1
+}
+
+if [ ! -z "${PRECOMMIT_NOFMT}" ] ; then
+    exit 0
+fi
+
+echo checking formatting and licenses 1>&2
+project_pathname=$(git rev-parse --show-toplevel)
+cd "${project_pathname}"
+make check