chore: minor fixups across errors, oci_container, and options (#2860)

* chore: minor fixups across errors, oci_container, and options

- Strengthen error message wording: 'is expected to' → 'must' and
  'is expected to place one' → 'must place exactly one' in
  FailedWheelRepairError classes.
- Remove shell=True from subprocess.run in oci_container debug_info,
  passing command as a list instead of a string.
- Update pinned image error message from 'cibuildwheel 3.x' to
  'cibuildwheel 4.x' and add comment about next warning candidate.

Assisted-by: OpenCode:glm-5

* Update cibuildwheel/options.py

cibuildwheel/options.py

@@ -708,11 +708,12 @@ class Options:
 
     def _check_pinned_image(self, value: str, pinned_images: Mapping[str, str]) -> None:
         error_set = {"manylinux1", "manylinux2010", "manylinux_2_24", "musllinux_1_1"}
+        # Currently no warnings, next: https://github.com/pypa/manylinux/issues/1925
         warning_set: set[str] = set()
 
         if value in error_set:
             msg = (
-                f"cibuildwheel 3.x does not support the image {value!r}. Either upgrade to a "
+                f"cibuildwheel 4.x does not support the image {value!r}. Either upgrade to a "
                 "supported image or continue using the image by pinning it directly with"
                 " its full OCI registry '<name>{:<tag>|@<digest>}'."
             )