fix: always enable production vfs fallback

[neebs12]

Summary

• always try vfs after the preferred Docker storage driver fails
• remove the production opt-in flag and accept a validated vfs daemon
• exercise the default fallback path in unit and real ARM64 image smoke tests
• document overlay2 as preferred and vfs as a supported production fallback

Validation

• npm run check
• npm run test:image
• shellcheck scripts/*.sh test/scripts/*.sh
• reproducible runner image artifact check
• stale fallback-policy documentation scan

[neebs12]

Verified in PR CI and integrated into the rewritten single root commit on main.