investigate switch to NRI for product mounts

See: https://github.com/containerd/nri/tree/main/plugins/hook-injector

More context: https://github.com/containerd/containerd/issues/6262

/kind cleanup

This will let us avoid skew in the OCI base config ...

Though I won't be surprised when users start depending on the OCI hooks directory being available >.< If you're reading this: don't do that. depending on the contents of the kind image is NOT supported. Only that it runs Kubernetes. We need room to make changes like this.