runtime-rs: Support Pod-level checkpoint and restore with sandbox service

KEP References

First of all, Thanks the KEP owners bring us such amazing feature!

• KEP: KEP-5823: Pod-Level Checkpoint/Restore
• CRI API proto: https://github.com/kubernetes/cri-api/blob/release-1.37/pkg/apis/runtime/v1/api.proto
• Kubernetes release: v1.37
• KEP owners: @rst0git, @viktoriaas, @adrianreber, @andreyvelich
• SIG-Node liaison: TBD
• KEP shepherd: TBD

Problem

KEP-5823 adds CheckpointPod and RestorePod to CRI. containerd needs to coordinate these Pod-level operations with sandbox runtimes.

Independent container checkpoints cannot capture a consistent VM or shared sandbox. The sandbox runtime must own the Pod-wide execution-state boundary, while containerd must continue to own CRI validation, lifecycle locking, CNI, NRI, new IDs, task adoption, publication, rollback, and restart recovery.

Alternatives and extensibility

We considered these alternatives:

• independent container checkpoints do not provide a consistent VM or sandbox checkpoint;
• interpreting checkpoint formats in containerd would couple CRI to individual runtimes;
• delegating the whole operation to the runtime would bypass containerd-owned CNI, NRI, metadata, task, and rollback semantics;
• skipping NRI would make restored workloads differ from normally created workloads;
• always creating a new snapshot can replace checkpoint-authoritative writable state for a runtime-owned-rootfs implementation.