rkt: validate OS/arch during run/unpack