fix(shim): support non-CRI callers (BuildKit, ctr) in containerd shim

[copybara-service]

fix(shim): support non-CRI callers (BuildKit, ctr) in containerd shim

Summary

Fix two issues that prevent gVisor containers from working when created through containerd's direct API (non-CRI), such as BuildKit's containerd worker or ctr run.

1. Sandbox detection for non-CRI callers

SpecContainerType returns ContainerTypeUnspecified for non-CRI callers that don't set the container type annotation (io.kubernetes.cri.container-type). Previously this resulted in p.Sandbox=false, which skipped passing IO file descriptors to runsc create. Without IO, container processes receive SIGPIPE on stdout/stderr writes and exit with code 128.

Fix: treat ContainerTypeUnspecified as sandbox, since non-CRI containers are always root/sandbox containers.

2. Wait error handling for short-lived containers

For short-lived containers, the sandbox may exit before runsc wait retrieves the exit status, producing "sandbox no longer running and its exit status is unavailable". This error was treated as fatal (setting internalErrorCode=128) even when the container exited successfully (status=0).

Fix: extract adjustWaitStatus() function — when status is 0, log the error as a warning but preserve the exit status.

Test plan

• TestSandboxDetection — 9 cases covering all container type variants including no-annotation (BuildKit/ctr), containerd sandbox/container, CRI-O sandbox/container, unknown values, dual annotations
• TestAdjustWaitStatus — 9 cases covering status=0 success, non-zero exit, signal exit (137), benign sandbox error with status=0, non-zero with error, negative status, exit 255
• E2E: BuildKit containerd worker with gVisor on GCE e2-standard-4, containerd v1.7.29, runsc release-20260330.0. Eight consecutive RUN steps (echo, ls, resolv.conf, apk add curl jq + curl HTTPS, exit code, multi-line script, id, uname) all pass with exit code 0.

Fixes #12198

FUTURE_COPYBARA_INTEGRATE_REVIEW=#12873 from alan890104:minimal-fix c5fdfd4