[Task]: Build a reusable test bundle + rootfs fixture

[michael-duren]

What needs to be done

Acceptance tests need an OCI bundle to run: a directory containing a
config.json and a rootfs/ with at least a shell/sleep binary. Provide a
reusable helper that materializes a bundle in a temp dir so each test gets an
isolated, throwaway container to drive.

The helper should:

• Produce a minimal rootfs/ containing a static binary the tests can run
  (e.g. a statically-linked busybox or a tiny Go sleep built static), so the
  container has something to exec without depending on host libraries.
• Generate a config.json based on the runtime spec we already use in unit tests
  (see internal/container/testdata_test.go), with process.args pointing at
  that binary, and the namespaces the runtime expects.
• Allow per-test overrides (the process args, hostname, readonly root, etc.).
• Clean itself up (temp dir + t.Cleanup, or an equivalent for a shell suite).

Decide the rootfs source per #18 (vendor a
small tarball vs. build static binary at test time vs. fetch). Record the choice.

Acceptance criteria

• A helper that writes a complete bundle (config.json + rootfs/) to a temp dir
• The rootfs contains a runnable static binary the lifecycle test can exec
• config.json is derived from the shared test spec and supports per-test overrides
• Bundles are isolated per test and cleaned up afterward
• The rootfs acquisition method is documented and reproducible (no network at test time, or clearly gated if there is)

Parent / tracking issue

Part of #17.

Blocked by

• [Task]: Research & design the acceptance test harness #18

Rough size

M — a day or two