containerization: guard patch #3's 'import os' behind #if canImport(os)

The swiftly toolchain used by the vminit-image CI resolves Foundation/
Virtualization but not the 'os' overlay, so 'import os' failed with
"no such module 'os'". Guarding the diagnostic logger degrades it to a
no-op under such toolchains while local (Xcode) builds keep it.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

PATCHES.md

@@ -35,7 +35,10 @@ in-tree means the patch can't be lost to a dependency re-resolve.
    readability handler is never wired and the agent's stdin is never delivered (it hangs) or its
    stdout is never read (the "no output, just a spinner" symptom in Nucleic Control containers).
    Behavior is unchanged; it only surfaces the failing stream. Marked `[Nucleic vendored patch]`
-   (the `import os`, the `nucleicIOLog` static, and the per-stream check in `setupIO`).
+   (the `import os`, the `nucleicIOLog` static, and the per-stream check in `setupIO`). All three are
+   wrapped in `#if canImport(os)` — the swiftly toolchain used by `.github/workflows/vminit-image.yml`
+   resolves Foundation/Virtualization but not the `os` overlay, so the diagnostic degrades to a no-op
+   there instead of failing the build; Xcode (local) builds keep it.
 
 4. **Trimmed for footprint (no behavior change).** `Tests/`, `docs/`, `examples/`, and `images/`
    were dropped, and the corresponding `.testTarget(...)` entries removed from `Package.swift`. The