Add comments to all source and header files

- include/container.h: document struct fields and constants
- src/main.c: explain argument parsing, clone flow, parent/child roles
- src/mount.c: describe 6-step mount isolation process
- src/cgroup.c: explain cgroup data structures and resource setup/cleanup
- src/capabilities.c: document capability drop (bounding + inheritable)
- src/seccomp.c: explain each seccomp rule's security purpose
- src/userns.c: describe parent-child sync and uid_map/gid_map format
- src/hostname.c: document tarot card random naming scheme

src/hostname.c

@@ -1,26 +1,43 @@
+/* hostname.c — 随机主机名生成模块
+ *
+ * 基于当前时间戳的纳秒部分，从 78 张塔罗牌中随机选取一张作为主机名。
+ * 格式：<5位时间戳十六进制>-<塔罗牌名>
+ * 例如：1204f86c-king-of-cups
+ *
+ * 78 张牌 = 22 张大阿卡纳 + 56 张小阿卡纳（4花色×14数字）
+ */
+
 #include <stdio.h>
 #include <time.h>
 #include "hostname.h"
 
 int choose_hostname(char *buff, size_t len)
 {
+	/* 小阿卡纳四花色 */
 	static const char *suits[] = { "swords", "wands", "pentacles", "cups" };
+	/* 小阿卡纳 14 张数字牌 */
 	static const char *minor[] = {
 		"ace", "two", "three", "four", "five", "six", "seven", "eight",
 		"nine", "ten", "page", "knight", "queen", "king"
 	};
+	/* 大阿卡纳 22 张 */
 	static const char *major[] = {
 		"fool", "magician", "high-priestess", "empress", "emperor",
 		"hierophant", "lovers", "chariot", "strength", "hermit",
 		"wheel", "justice", "hanged-man", "death", "temperance",
 		"devil", "tower", "star", "moon", "sun", "judgment", "world"
 	};
+
+	/* 用单调时钟的纳秒部分做随机种子 */
 	struct timespec now = {0};
 	clock_gettime(CLOCK_MONOTONIC, &now);
-	size_t ix = now.tv_nsec % 78;
+	size_t ix = now.tv_nsec % 78;  /* 78 张牌 */
+
 	if (ix < sizeof(major) / sizeof(*major)) {
+		/* 0~21：大阿卡纳 */
 		snprintf(buff, len, "%05lx-%s", now.tv_sec, major[ix]);
 	} else {
+		/* 22~77：小阿卡纳（数字 + 花色） */
 		ix -= sizeof(major) / sizeof(*major);
 		snprintf(buff, len,
 			 "%05lxc-%s-of-%s",