refactor(shim): unify config.json access via PatchConfig

[mdryaan]

Description

PRs #565, #657, and #702 each added shim logic that independently opens, reads, and writes config.json. This resulted in two separate read-unmarshal-marshal-write cycles inside a single TaskService.Create call, a non-atomic write in guest_rootfs.go, and the same constant defined in two places.

Introduce PatchConfig(bundlePath, fn) in pkg/containerd-shim/containerd/config.go as the single entry point for all config.json mutation in the shim. It reads config.json once, applies fn to the spec, and writes back atomically. atomicWriteFile moves from annotations.go into this new file. InjectUruncAnnotations and chooseGuestRootfs both replace their inline I/O with a PatchConfig closure. annotRootfsParams is promoted tointernal/constants.AnnotRootfsParams and the duplicate local declarations are removed.

Related issues

• Fixes Merge the management of the config file from the shim #719

How was this tested?

Changed files:

• internal/constants/constants.go — added AnnotRootfsParams
• pkg/containerd-shim/containerd/config.go — new file with
  PatchConfig and atomicWriteFile
• pkg/containerd-shim/containerd/annotations.go — removed
  patchConfigJSON and atomicWriteFile, InjectUruncAnnotations
  now calls PatchConfig
• pkg/containerd-shim/guest_rootfs.go — removed inline I/O and
  local constant, chooseGuestRootfs now calls PatchConfig
• pkg/unikontainers/rootfs.go — removed duplicate constant
• pkg/unikontainers/unikontainers.go — uses
  constants.AnnotRootfsParams

Verified by code inspection that every config.json open/read/write in the shim now routes through PatchConfig, the non atomic write in chooseGuestRootfs is replaced by the atomic write path, and the duplicate constant is eliminated. Build passes (make). Linter passes (golangci-lint run). Unit tests pass (go test ./pkg/unikontainers/...).

LLM usage

N/A

Checklist

• I have read the contribution guide.
• The linter passes locally (make lint).
• The e2e tests of at least one tool pass locally (make test_ctr,
  make test_nerdctl, make test_docker, make test_crictl).
• If LLMs were used: I have read the llm policy.

[netlify]

✅ Deploy Preview for urunc canceled.

Name	Link
🔨 Latest commit	aed5399
🔍 Latest deploy log	https://app.netlify.com/projects/urunc/deploys/6a13df970b9bf400081204cd

[mdryaan]

Hello @cmainas, please have look whenever you get a chance