Rename k-prefixed constants to snake_case, grouped in namespaces

Drop the k Hungarian-notation prefix throughout src/. Enum class values
(Mode::, OciPortProtocol::) are already qualified by the enum's own name,
so plain snake_case enumerators are enough. Free-standing constants also
move to snake_case; related ones are grouped under a named namespace
instead of relying on a shared prefix (main.cpp's getopt long-option
codes -> namespace options, bwrap.cpp's priv-drop path/binary name ->
namespace priv_drop). kMountProgram, which was actually mutable global
state rather than a true constant, is renamed to g_mount_program to
match this codebase's existing g_ convention for that kind of state.
Also dedupes the three identical kTabWidth local constants in main.cpp
into one shared tab_width.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

CLAUDE.md

@@ -481,6 +481,18 @@ Build directory is `buildDir/` (already configured).
 ## Code style
 
 - Null-pointer checks: prefer `if (!ptr)` / `if (ptr)` over `if (ptr == nullptr)` / `if (ptr != nullptr)`.
+- Constants: no `k` Hungarian-notation prefix. `enum class` values are already qualified by
+  the enum's own name (e.g. `Mode::run`, `OciPortProtocol::tcp`), so plain snake_case
+  enumerators are enough on their own. Free-standing constants also use plain snake_case;
+  when several are conceptually related, group them under a named `namespace` instead of
+  relying on a shared prefix to imply the grouping (e.g. `main.cpp`'s `getopt_long` long-option
+  codes live in `namespace options { constexpr int log_level = ...; }`, and `bwrap.cpp`'s
+  priv-drop-helper path/binary-name pair live in `namespace priv_drop { ... }`) — nest the named
+  namespace inside the file's existing anonymous namespace where one is already present, so
+  internal linkage is unchanged. A `kXxx`-named identifier that turns out not to actually be
+  `const` (mutable global/static state) instead follows this codebase's existing `g_` prefix
+  convention (e.g. `containers_storage.cpp`'s `g_mount_program`, matching `process.cpp`'s
+  `g_foreground_child_pid` and `daemonize.cpp`'s `g_report_fd`/`g_log_path`).
 
 ## Licensing