fix(shim): support non-CRI callers (BuildKit, ctr) in containerd shim

[alan890104]

Summary

Fix two issues that prevent gVisor containers from working when created through containerd's direct API (non-CRI), such as BuildKit's containerd worker or ctr run.

1. Sandbox detection for non-CRI callers

SpecContainerType returns ContainerTypeUnspecified for non-CRI callers that don't set the container type annotation (io.kubernetes.cri.container-type). Previously this resulted in p.Sandbox=false, which skipped passing IO file descriptors to runsc create. Without IO, container processes receive SIGPIPE on stdout/stderr writes and exit with code 128.

Fix: treat ContainerTypeUnspecified as sandbox, since non-CRI containers are always root/sandbox containers.

2. Wait error handling for short-lived containers

For short-lived containers, the sandbox may exit before runsc wait retrieves the exit status, producing "sandbox no longer running and its exit status is unavailable". This error was treated as fatal (setting internalErrorCode=128) even when the container exited successfully (status=0).

Fix: extract adjustWaitStatus() function — when status is 0, log the error as a warning but preserve the exit status.

Test plan

• TestSandboxDetection — 9 cases covering all container type variants including no-annotation (BuildKit/ctr), containerd sandbox/container, CRI-O sandbox/container, unknown values, dual annotations
• TestAdjustWaitStatus — 9 cases covering status=0 success, non-zero exit, signal exit (137), benign sandbox error with status=0, non-zero with error, negative status, exit 255
• E2E: BuildKit containerd worker with gVisor on GCE e2-standard-4, containerd v1.7.29, runsc release-20260330.0. Eight consecutive RUN steps (echo, ls, resolv.conf, apk add curl jq + curl HTTPS, exit code, multi-line script, id, uname) all pass with exit code 0.

Fixes #12198

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.