Wire -c/--config-file's effective config into the self-test suite

run_self_tests() now takes the same effective AppConfig any other command
gets and stashes it into a new g_test_app_config global (tests/support/
fixtures.h) before Catch2 runs anything. test_rootless_run.cpp's own
run_in_fixture() reads a copy of it instead of a hardcoded default
AppConfig{}, so -c actually reaches that test's container creation.

Verified: a config with every unshare-*/with-* key set to false, used via
-c <file> -t -- "[integration][net]~[root]", flips all 3 of that file's
container-creating tests to failing -- including the nohup-straggler
regression test, since with neither a pid namespace nor a cgroup nothing
reaps the backgrounded process -- while [unit] and non-networking
[integration] tests are completely unaffected, as expected.

tests/integration/test_rootless_run.cpp

@@ -125,7 +125,12 @@ std::string run_in_fixture(const std::filesystem::path& image, const std::vector
     args.mode_arg = image.string();
     args.command = command;
 
-    AppConfig config;
+    // A fresh copy of the current -t run's effective config (g_test_app_config,
+    // fixtures.h -- set once by run_self_tests() from whatever main() resolved,
+    // respecting -c/--config-file) rather than a hardcoded AppConfig{}, so this
+    // helper's containers reflect the same global settings a real -r/--run
+    // invocation would.
+    AppConfig config = g_test_app_config;
     CapturedStdout capture;
     // config_path is only ever consulted by modes that read/write a config
     // file (-w/--write-config, -v/--volume, -n/--network); Mode::run

tests/support/fixtures.cpp

@@ -26,6 +26,8 @@
 #include <system_error>
 #include <vector>
 
+AppConfig g_test_app_config;
+
 std::optional<std::filesystem::path> find_busybox_fixture() {
     std::error_code ec;
     auto path = std::filesystem::current_path(ec) / "images" / "busybox.tar";

tests/support/fixtures.h

@@ -20,6 +20,20 @@
 #include <optional>
 #include <string>
 
+#include "config_file.h"
+
+// The effective AppConfig for the current -t/--test run -- set once by
+// run_self_tests() (self_test.cpp) from whatever main() resolved (respecting
+// -c/--config-file, same as any other command), before Catch2 ever runs a
+// TEST_CASE. Test code that creates a real container (test_rootless_run.cpp's
+// own run_in_fixture()) reads this instead of hardcoding a fresh, default
+// AppConfig{}, so e.g. `-c <all-unshare-off.yaml> -t -- "[integration][net]"`
+// actually exercises what happens with pid/cgroup isolation disabled. Plain
+// default-constructed AppConfig{} otherwise (matching every test's prior,
+// unconditional behavior) -- a bare `-t` with no `-c` and no real config file
+// changes nothing.
+extern AppConfig g_test_app_config;
+
 // Path to a real, runnable OCI Image Layout tar (something with an actual
 // /bin/sh, unlike tests/gen_fixture.py's minimal single-file fixture used
 // by the plain mount/unmount smoke test) for [integration][net] tests that