feat: download containerd with oras in network isolated windows cluster

[jiashun0011]

What this PR does / why we need it:

/kind feature

Which issue(s) this PR fixes:

Download containerd with oras in network isolated windows cluster.

[Copilot]

Pull request overview

Adds Windows network-isolated-cluster support for downloading containerd via ORAS when a bootstrap profile container registry is configured, with corresponding unit and e2e coverage.

Changes:

• Update Windows Install-Containerd to download via ORAS when BootstrapProfileContainerRegistryServer is set, falling back to HTTP otherwise.
• Add a new Windows CSE error code for ORAS containerd pull failures.
• Add Pester unit tests and an e2e scenario to validate the ORAS containerd download path.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
staging/cse/windows/containerdfunc.ps1	Adds ORAS-based containerd download path gated by BootstrapProfileContainerRegistryServer.
staging/cse/windows/containerdfunc.tests.ps1	Adds Pester coverage for the new ORAS/HTTP branching and retry/error behavior.
parts/windows/windowscsehelper.ps1	Introduces a new error code constant and updates error code bookkeeping.
e2e/scenario_win_test.go	Adds a network-isolated Windows scenario asserting containerd ORAS download logging.

[fseldow]

lgtm

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

BootstrapProfileContainerRegistryServer is sanitized here (scheme stripped + trailing slash trimmed) before constructing the ORAS reference, but other ORAS call sites (e.g. kubelet download) build references directly from the raw global value. If the input ever includes http(s):// or a trailing / (as covered by the new tests), this can cause kubelet/containerd to target different (or invalid) registry references. Consider normalizing BootstrapProfileContainerRegistryServer once (e.g., in config/setup) and reusing that normalized value everywhere ORAS references are constructed.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

parts/windows/windowscsehelper.ps1 redefines Set-ExitCode to call exit. In this test file, the earlier function Set-ExitCode { ... } stub is therefore overwritten when windowscsehelper.ps1 is dot-sourced, which makes the stub ineffective and can cause the Pester run to terminate if any code path reaches Set-ExitCode before an explicit Mock Set-ExitCode is applied.

To make the tests robust, either re-define the stub after dot-sourcing windowscsehelper.ps1, or add a Mock Set-ExitCode in BeforeAll to ensure the real exit implementation is never invoked during this test run.

Suggested change

	. $PSScriptRoot\..\..\..\parts\windows\windowscsehelper.ps1
	. $PSScriptRoot\..\..\..\parts\windows\windowscsehelper.ps1
	# windowscsehelper.ps1 defines Set-ExitCode to call exit; restore the
	# test-safe stub after dot-sourcing so later imports/tests cannot terminate
	# the Pester session.
	function Set-ExitCode {
	param($ExitCode, $ErrorMessage)
	Write-Host "MOCK: Exit Code would be: $ExitCode, Error: $ErrorMessage"
	# Don't actually exit in tests
	}
	Mock Set-ExitCode -MockWith {
	param($ExitCode, $ErrorMessage)
	Write-Host "MOCK: Exit Code would be: $ExitCode, Error: $ErrorMessage"
	}