host-ctr: protect cached snapshots during image unpack

[AnthonyDiSanti]

Closes #1059

Description of Changes

Runs unpacking inside Client.Pull using WithPullUnpack and the existing default snapshotter. The separate Image.Unpack cached-layer path can return success after garbage collection has removed a parent snapshot, leaving the image unusable when host-ctr creates a container. The integrated unpacker protects cached snapshots during this boundary.

Preserves the resolver, schema conversion, labels and retry loop - unpack failures now participate in the same bounded retry. Adds an opt-in integration test calling the real pullImage against disposable containerd. It forces synchronous GC at the cached-layer boundary and again after Pull returns, then creates a child snapshot. The test needs no external registry, credentials or image execution and includes a companion note documenting how to run it.

Testing

• gofmt and go test ./... in sources/host-ctr, Go 1.26.1.
• New integration test with develop's containerd client 1.7.35 and containerd server 2.2.7/overlayfs on Linux ARM64: unmodified source fails with parent snapshot ... does not exist; patched source passes.
• Earlier controlled reproduction also passed the candidate API path against Bottlerocket 1.65.0's native host-containerd 2.2.7 using client 1.7.33, as recorded in host-ctr: cached layer snapshot can disappear after separate unpack #1059.

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.