fix(shim): bound teardown waits so a leftover bundle can't wedge a container

[austinvazquez]

On Windows a container id could be wedged permanently: every start returned

creating containerd task for container : failed to remove stale bundle
path "...": unlinkat ...<id>\merged_fs_gpt_header.bin: Access is denied.

The bundle holds VMDK descriptors and auxiliary blobs that the VM maps while it runs, and a mapped file cannot be unlinked on Windows. Teardown had two unbounded waits that let containerd race ahead of the release:

• manager.Stop waited on WaitForSingleObject(h, INFINITE) for the shim to exit. containerd bounds the whole shim delete call by io.containerd.timeout.shim.cleanup (5s), so it killed us mid-call — "failed to delete dead shim: exit status 1" — and a killed process runs no defers, so the bundle cleanup never ran at all. TerminateProcess is not instantaneous for a VM-backed shim whose threads sit in kernel-mode hypervisor calls.
• service.shutdown waited on sb.Stop with no bound. A vm.Instance that does not honour its context cannot be cancelled from there, and a callback that never returns keeps the shutdown service from ever completing.

Changes:

• Bound the shim-exit wait and make it observe ctx. On expiry, report a valid StopStatus instead of an error: containerd deletes the bundle either way, so the useful thing is to finish under our own control with the cleanup done, and to name the surviving pid.
• Widen cleanup from rootfs to every artifact the shim wrote, classified by erofs.IsBundleArtifact and enumerated with ReadDir. Enumeration rather than globbing because a bundle path holding a glob metacharacter would match nothing and report no error, and on Windows cannot be escaped. Retries run under one deadline for the whole set, not per file, so the total stays inside containerd's cleanup budget.
• Keep the descriptor and blob names beside the writers that derive them, so teardown cannot drift from what was written.
• Bound the in-shim teardown: the best-effort guest unmount gets a flat timeout so it cannot starve the VM stop, the VM stop gets the caller's remaining context, and rootfs removal plus the forwarder sentinel move to a defer so a hang cannot skip them.
• Apply the same bounded wait on unix, and reject a non-positive shim pid before it reaches kill, where 0 would signal the whole process group.

This bounds the damage and makes the failure diagnosable, but cannot by itself release a handle held elsewhere.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.