Rename k-prefixed constants to snake_case, grouped in namespaces

Drop the k Hungarian-notation prefix throughout src/. Enum class values
(Mode::, OciPortProtocol::) are already qualified by the enum's own name,
so plain snake_case enumerators are enough. Free-standing constants also
move to snake_case; related ones are grouped under a named namespace
instead of relying on a shared prefix (main.cpp's getopt long-option
codes -> namespace options, bwrap.cpp's priv-drop path/binary name ->
namespace priv_drop). kMountProgram, which was actually mutable global
state rather than a true constant, is renamed to g_mount_program to
match this codebase's existing g_ convention for that kind of state.
Also dedupes the three identical kTabWidth local constants in main.cpp
into one shared tab_width.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

src/exec_session.cpp

@@ -62,7 +62,7 @@ struct JoinableNamespace {
 // net is deliberately excluded: this project never isolates networking either
 // (see build_bwrap_args() dropping --unshare-net), so there's nothing meaningful
 // to join there.
-constexpr std::array<JoinableNamespace, 6> kJoinableNamespaces = {{
+constexpr std::array<JoinableNamespace, 6> joinable_namespaces = {{
     {"mnt", "--mount", true},
     {"uts", "--uts", false},
     {"ipc", "--ipc", false},
@@ -103,7 +103,7 @@ int exec_in_session(pid_t pid, const std::vector<std::string>& command) {
     pid_t ns_pid = resolve_namespace_pid(pid);
 
     std::vector<std::string> argv = {"nsenter"};
-    for (const auto& ns : kJoinableNamespaces) {
+    for (const auto& ns : joinable_namespaces) {
         auto target_ns = read_ns_link(fmt::format("/proc/{}/ns/{}", ns_pid, ns.proc_name));
         if (!target_ns) {
             if (ns.required) {