[hanthor]

Summary

• Add matching tux:100000:65536 entries in /etc/subuid and /etc/subgid through the image's existing root filesystem copy.
• Give the sysusers-created sandbox account subordinate UID/GID ranges so rootless Podman does not report missing ranges or fall back to a single-ID mapping.
• Keep this fix independent of the MOTD change in fix(centos-bootc): suppress sandbox user login messages #15.

Validation

• Checked both mapping files for valid entries, matching ranges, and at least 65,536 IDs with no overlap with tux's UID 60000.
• git diff --cached --check passed.
• Confirmed the branch changes only the two mapping files.
• Rootless Podman in a booted sandbox has not been verified.