v0.3.4

What's Changed

• Add containerd as alternative CRI runtime (--cri-runtime=containerd)
• Fix shell injection in Nix::run() by passing args individually instead of joining into bash -c
• Validate --packages names to prevent Nix expression injection
• Fix Unix socket path length check to use byte length instead of display length
• Quote interpolated paths in new_shell() to handle spaces correctly
• Forward --cri-runtime flag in bootstrap re-exec
• Add shared CRI abstractions (cri.rs) to deduplicate CNI config and container cleanup
• Add integration tests for containerd (single and multi-node)

Full Changelog: v0.3.3...v0.3.4