refactor(driver-vm): replace OCI registry client with containerd shim

The VM driver's registry pull and layer-unpack logic was a hand-rolled
OCI client (auth, manifest parsing, per-layer download, digest
verification) plus a from-scratch tar-layer merge that only understood
plain files, dirs, symlinks, and OCI whiteouts.

Replace it with containerd's own Go client libraries
(core/remotes/docker, core/content/local, pkg/archive) for
OCI-correct registry resolve/fetch/auth and layer application,
including opaque dirs, xattrs, and device/fifo entries. No containerd
daemon is involved: the new goshim/ Go module links those packages
directly and builds into a small cgo shared library
(libopenshell_containerd_shim), loaded at runtime via libloading the
same way this crate already loads libkrun.

- goshim/: exports ContainerdResolveDigest, ContainerdPullImage, and
  ContainerdUnpackLayout.
- src/containerd_shim.rs: dynamic loader and safe Rust wrappers,
  mirroring ffi.rs's LibKrun pattern.
- src/driver.rs: removed the manual registry client, layer-merge, and
  OCI layout writer (~1000 net lines); both pull paths now call the
  shim.
- build.rs / embedded_runtime.rs: embed the shim like
  libkrun/libkrunfw/gvproxy.
- tasks/scripts/vm/build-containerd-shim.sh: builds the shim natively
  or cross-compiled, wired into vm:setup and CI.
- Dropped oci-client, flate2, sha2; added go to mise.toml/mise.lock.

Registry auth env vars are unchanged. Per-layer pull progress is now a
single event instead of one per layer, since the whole pull happens in
one blocking call into the shim.

Verified against a live registry (docker.io/library/busybox) through
the built shared library via libloading, and cross-built for macOS
with docker buildx/osxcross.

Signed-off-by: Eric Curtin <eric.curtin@docker.com>

Author: ericcurtin

.github/workflows/driver-vm-linux.yml

@@ -147,10 +147,16 @@ jobs:
           OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
             tasks/scripts/vm/build-supervisor-bundle.sh --arch "${{ matrix.guest_arch }}"
 
+      - name: Build containerd shim
+        run: |
+          set -euo pipefail
+          OPENSHELL_VM_RUNTIME_COMPRESSED_DIR="${PWD}/target/vm-runtime-compressed" \
+            mise x -- tasks/scripts/vm/build-containerd-shim.sh
+
       - name: Verify embedded driver inputs
         run: |
           set -euo pipefail
-          for file in libkrun.so.zst libkrunfw.so.5.zst gvproxy.zst umoci.zst openshell-sandbox.zst; do
+          for file in libkrun.so.zst libkrunfw.so.5.zst gvproxy.zst umoci.zst openshell-sandbox.zst libopenshell_containerd_shim.so.zst; do
             test -s "target/vm-runtime-compressed/${file}"
           done