fix: install a default guest kernel in setup, stop the runtime for the updater

[vyncint]

Two gaps a full teardown-and-reinstall cycle exposed on a real machine.

1. setup leaves apple/container without a guest kernel

apple/container cannot boot any VM until a default guest kernel is configured. A fresh install has none — and neither does one whose user data was deleted, which cleanup --all -d does by design (it passes -d through to apple/container's uninstaller, wiping its kernels/ directory). So the teardown → reinstall path this repo now encourages lands in a state where every sandbox create fails:

Error: default kernel not configured for architecture arm64, please use
the `container system kernel set` command to configure it

…with nothing in setup's output hinting at the cause. setup claims to wire the whole stack, so it should cover this prerequisite.

Fix: setup checks for ~/Library/Application Support/com.apple.container/kernels/default.kernel-<arch> and, when absent, runs container system kernel set --recommended (terminal-attached, so the ~600 MB download shows progress).

Deliberately non-fatal: setup is the documented repair command, so a transient download failure must not stop it from fixing the rest of the wiring. It warns loudly (SANDBOXES WILL NOT BOOT until one is set) with the retry command and the manual --tar fallback. Detection is conservative — it only acts when no default kernel exists at all, so a machine that already has one is untouched.

2. update --all always failed on apple/container

The updater refuses to run while the runtime is up, and updatePrerequisites never stopped it:

`container` is still running. Please ensure the service is stopped by running `container system stop`
WARN apple/container updater failed err="exit status 1"

Fix: stop the runtime first (as the uninstall path already did), then restart it afterwards so --no-setup doesn't leave it down.

Verification

• New tests cover both kernel branches: installs when missing, and does not reinstall when a default is already configured.
• go test -race ./..., golangci-lint (0 issues), make sec all clean.
• Live on this machine, reproducing the whole cycle: cleanup --all -d → fresh install.sh → sandbox create failed with the kernel error (confirming kernels/ was empty); installing the kernel made create reach Ready and exec uname -a return Linux … 6.18.15 aarch64. With the fix built and installed, setup correctly skipped the kernel step on the now-configured machine and completed normally.
• README troubleshooting table documents the symptom.