initscript: change the default policy from always to newer

Just like the always policy, this will make podman query the registry to see if the image has changed or not, pull it if it was updated or reuse the local one if nothing changed.

The difference is that, unlike with the always policy, the local image will be used if any pulling error happened.

This policy works better for additional image stores and trades off consistency of execution (we may end up running an older image) for reliability. Users absolutely caring about ensuring they are running the latest image should add --pull=always to their run cmdline.