feat(config): reject OnlineContainerized with a non-Proton runner at save time (Phase 5)

[weter11]

Phase 5 — OnlineContainerized runner validation guard

What

Reject OnlineContainerized steam-mode config updates when the effective runner is
not a Proton compatibility tool, at save time instead of failing at launch.

• src/config.rs — validate_online_containerized_runner(steam_mode, forced_proton_version, global_proton_version, library_root) -> Result<(), String>.
  Mirrors resolve_effective_proton_name precedence (per-game forced_proton_version
  → global proton_version) and requires classify_runner → RunnerKind::Proton
  (a proton entry script).
• src/ui.rs — the per-game settings save path runs the guard before persisting;
  a rejected update is not saved and the status bar shows:
  Configuration rejected: OnlineContainerized mode requires a Proton compatibility tool runner (e.g., steamflow-proton-11.0-purepe). Bare Wine runners are not supported in container mode.
• Unit tests (src/config.rs): Proton accepted (forced + global), bare Wine
  rejected (forced + global, exact message), OfflineEmulated/Auto never blocked,
  empty forced override falls back to the global runner.
• docs/architecture/phase5-onlinecontainerized-validation.md — guard design plus
  the Phase 5 launch-path logging facts (PROTON_LOG, debug.json precedence, runner
  matrix, P2 white-screen context).

Why

The Phase 5 Portal 2 (620) diagnostic found a config trap: the containerized launch
path runs <proton>/proton run inside the Steam Linux Runtime, which a plain Wine
runner (e.g. steamflow-runner-wine11-wow64) cannot satisfy — it fails at launch
with "OnlineContainerized requires a Proton compatibility tool". Worse, steam_mode
(user_apps.json) and the runner pin (config.json) are stored separately, so a
containerized test can silently run a different runner than the files state. The
guard makes the mismatch explicit at save time.

Phase 5 findings (documented in the skill + repo docs)

1. PROTON_LOG only works on the proton-script path — DirectWine bare-wine runs
   produce no ~/steam-<appid>.log; wine debug goes to WINE_LOG_OUTPUT
   (logs/wine_<appid>.log).
2. debug.json env is applied last in build_env and overrides CLI
   WINEDEBUG; the proton script also rewrites WINEDEBUG.
3. OnlineContainerized × runner matrix — Proton runner required; bare Wine
   rejected.

Verification

• cargo test --all-targets — passes (141 lib tests + all integration binaries).
• cargo clippy --all-targets — 0 errors after fixing two pre-existing
  non_octal_unix_permissions deny-lint sites (set_mode(0) → 0o0,
  src/steam_client.rs) — same semantics, in a separate fix(clippy) commit.
• My code region is rustfmt-clean (the repo has broad pre-existing fmt drift; not
  touched).