fix(trace-fixtures): require podman label on fixture-vm workflows

[avrabe]

Summary

Both fixture-vm flake.lock runs landed on runner8 and died at the
rootless-podman userns step (newuidmap: write to uid_map failed: Operation not permitted). The image digest is correct; the failure is
in the runner's rootless-podman setup, one layer below the container.

Per smithy, rootless podman is only known-good on runner9 right now.
This adds podman to the runs-on label set on both workflows so GHA
schedules only on a podman-capable runner. KVM access is universal on
the fleet, so no kvm label is needed on the nightly.

Test plan

• Merge, then re-dispatch fixture-vm flake.lock — first real
  end-to-end exercise of the rootless-podman + digest-pinned
  nixos/nix chain. Artifact fixture-vm-flake-lock comes back
  on success.
• Commit the produced flake.lock in a follow-up PR; the nightly
  then goes live.

🤖 Generated with Claude Code

[github-actions]

Rivet verification gate

✅ 20/20 passed

	count
Passed	20
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!