fix: decode Apple inspect state object and nested ipv4 address

[jahirvidrio]

What problem does this solve?

fetchContainerInfo cast status to String (Apple emits it as an object)
and read networks at the top level (they live nested under status.networks).
Both casts silently failed, so every container reported as running with an
empty IP. This broke the mocker ps status column for stopped containers,
the State fields in mocker container inspect, and Compose /etc/hosts
injection (which silently no-ops because networkAddress is empty).

What changed

• Extracted a pure static ContainerEngine.decodeInspect so the decode logic
  is unit-testable without a live container, and rewired fetchContainerInfo
  to call it. Returns nil to keep the existing outer fallback intact.
• Strip the /24 mask from status.networks[0].ipv4Address so the IP we hand
  to mocker ps, the inspect DTO, and Compose hostname resolution is plain.
• Unknown Apple states fall back to .running (safe default — a live container
  is never hidden from mocker ps).
• Replaced three hardcoded "Exited (0)" strings with
  ContainerState.exited.displayString so the stopped display is honest
  ("Exited" — no fake exit code, per the maintainer's "omit > fake" policy).

[us]

Thanks @jahirvidrio — great catch. 🙌 The old status as? String + top-level networks casts were both silently failing, so every container read as running with an empty IP. Nice that one fix covers ps, the container inspect State/IP, and the Compose /etc/hosts injection at once.

Verified locally: builds clean, full suite green (your 11 decodeInspect tests included). I also corroborated the decode keys against the Containerization framework types — ContainerizationOCI.ContainerState is exactly running/stopped, and Interface.ipv4Address is a CIDRv4, so both the key names and the /mask strip are correct. Extracting a pure decodeInspect so it's unit-testable without a live container is exactly the right call, and using ContainerState.exited.displayString instead of a fabricated (0) exit code fits the omit-over-fake policy.

Merging now — thanks for the fix!