Surface a clear error when system start cannot write app-root

[rogerneal]

Summary

• Wrap app-root directory creation and apiserver plist writes so a non-writable --app-root fails with a clear ContainerizationError instead of an opaque Cocoa / fatal path.
• Note: the original try! crash was already fixed in fix: propagate error from createDirectory in system start #1785; this finishes the user-facing side of [Bug]: container system start crashes with fatal error when app-root directory is not writable #1802 with actionable messaging and regression coverage.

Closes #1802

Test plan

Tested

• swift test --filter SystemStartAppRootTests (2/2 passed)
  • writable parent creates the directory
  • read-only parent throws a message containing app-root must be writable
• CLI repro with a build of this branch:

  ROOT=$(mktemp -d /tmp/container-approot-ro.XXXXXX)
  chmod 555 "$ROOT"
  bin/container system start --app-root "$ROOT" --disable-kernel-install

  • Exit code 1 (not 133)
  • No Fatal error / try!
  • Error: cannot create application data directory ... app-root must be writable

Not tested

• GitHub Actions PR build on apple/container