feat: add systemInfo volume source with actorIdentity data source

[Max Thompson (thompsonmax)]

Part of #802 (first PR: the actorIdentity data source; does not close the issue).

What changed and why

Adds a systemInfo volume source to ActorTemplate — a read-only volume whose files are generated by atelet on every Run/Restore, analogous to Kubernetes projected volumes. The initial data source, actorIdentity, writes the actor's own name to a configurable relative path:

spec:
  volumes:
  - name: system-info
    systemInfo:
      dataSources:
      - actorIdentity:
          path: actor-id
  containers:
  - name: main
    volumeMounts:
    - name: system-info
      mountPath: /run/ate   # the actor reads /run/ate/actor-id

Because the files are regenerated before the sandbox starts, they carry the resumed actor's own values regardless of what checkpointed state it boots from — the property the old hardcoded /run/ate identity mount provided, now as an explicit, extensible API that future data sources (identity JWTs, certificates — see #802) can slot into.

Behavior change: the automatic /run/ate/actor-id mount is removed; actors must opt in by declaring the volume (the e2e identity probe in this PR is the reference example).

Reviewer notes:

• Over half the diff is vendored + generated code (cmd/atelet/internal/third_party/atomicwriter/, atelet.pb.go, zz_generated.deepcopy.go, the CRD manifest). The hand-written surface is ~700 lines.
• System-info volume roots live under a new ActorPath/system-info/ host dir, deliberately separate from durable-dir/: the micro-VM durable machinery snapshots everything under the durable-dir root, and generated identity files must never be captured into snapshots.
• Known gap (pre-existing, tracked in Add a SystemInfo volume source to ActorTemplate for delivering per-actor generated files #802): the micro-VM runtime drops all non-default mounts, so systemInfo volumes are gVisor-only for now, which is the same limitation the old identity mount had.
• The e2e identity suite exercises the new API end-to-end with unchanged probe binary and assertions. It runs in the kind-cluster CI job (not run locally).

Checklist

• Issue is linked above
• Tests pass locally (go test ./...)
• Root-gated tests pass if applicable (N/A — no root-gated packages touched)
• Documentation updated if behavior changed (docs/api-guide.md: SystemInfo Volumes section with example)