docs(getting-started): add netavark and pasta host prep for werf 3

[alexey-igrychev]

Summary

Buildah host preparation for werf 3 now tells the reader to install netavark and pasta: without
netavark werf 3 fails at Buildah backend initialization, and without pasta a rootless RUN that
configures a network fails (werf/werf#7730).

What

• The Buildah host preparation instructions gain one werf-3-scoped bullet, in EN and RU, in the same
  6 configurator sources as chore(docs): update buildah install #769: netavark has to sit in a Podman helper binaries directory because
  $PATH is not searched, with a release-binary fallback for distributions that have no package, and
  a rootless build that configures a network also needs pasta from passt.
• install.sh --setup-buildah installs netavark — skipped when a helper directory already has the
  binary — and passt, and warns instead of failing where the packages do not exist. VERIFIED: the
  distribution packages do land netavark in a default helper directory (Ubuntu 24.04 →
  /usr/lib/podman; Fedora, CentOS Stream and Alpine → /usr/libexec/podman).
• UNVERIFIED: the warning path itself, on a distribution that packages neither binary (Ubuntu 22.04);
  a run of install.sh --setup-buildah there would settle it.
• Both installs run for every --version, not only for 3: the documented command hardcodes
  --version 2, so a werf-3 gate would stop them installing at all. A werf 2 user gets two extra
  packages, and two warnings on a distribution without them.

Why

Nothing in Getting Started mentions either binary, so a host prepared from the current instructions
fails werf 3 at backend initialization — with an error naming a Podman directory that the reader has
no reason to connect to werf.

[alexey-igrychev]

Review focus

• install.sh — the netavark helper-directory probe runs before the package install, so a host that
  already has the binary outside a package is left alone; confirm the four directories match the ones
  werf actually searches.

Follow-up

• Add the https://passt.top/builds/latest/ manual fallback to the passt warning; the netavark
  warning names one and Ubuntu 22.04 packages neither binary.