Accept and ignore a file's trusted, and give each runtime its own time to answer

The fourth review (hq issue 339): `trusted` is the catalogue's word and the
controller takes it out, but a controller that passes it on, an older one or
one rolled back to, must not cost a node its whole declaration. A file now
accepts it and nothing reads it; any other resource still refuses it. And a
podman that hangs no longer eats docker's ten seconds.

internal/apply/placement_guard.go

@@ -152,14 +152,15 @@ func readRuntimeRoots(ctx context.Context, run Runner) []string {
 		}
 	}
 	if run != nil {
-		ask, cancel := context.WithTimeout(ctx, 10*time.Second)
-		if root, err := run(ask, "docker", "info", "--format", "{{.DockerRootDir}}"); err == nil {
-			add(root)
+		// Each runtime has its own ten seconds: one that hangs costs the other nothing.
+		for _, q := range [][]string{{"docker", "info", "--format", "{{.DockerRootDir}}"},
+			{"podman", "info", "--format", "{{.Store.GraphRoot}}"}} {
+			ask, cancel := context.WithTimeout(ctx, 10*time.Second)
+			if root, err := run(ask, q[0], q[1:]...); err == nil {
+				add(root)
+			}
+			cancel()
 		}
-		if root, err := run(ask, "podman", "info", "--format", "{{.Store.GraphRoot}}"); err == nil {
-			add(root)
-		}
-		cancel()
 	}
 	daemonJSON := func(path string) {
 		raw, err := os.ReadFile(path)