Add run-operator-proof for one-target handoff/scrape/prove flows. Prefer podman-compose on Podman hosts but honor DCE_DOCKER_BIN overrides so offline smokes keep using fake compose shims.