fix(kubernetes): make snapshot pushes platform-safe

[ruirui6946]

Summary

• Upgrade the image-committer runtime to Alpine 3.21 and enforce nerdctl 2.x, whose commit path restores image content discarded after CRI unpack.
• Push committed images for the image-committer binary's explicit runtime platform instead of relying on nerdctl's implicit reduced-platform selection.
• Add focused unit coverage for the platform-specific nerdctl push arguments.

Closes #1382.

Testing

• Not run (explain why)
• Unit tests
  • go test ./cmd/image-committer -count=1
  • go test ./internal/controller -run 'Test(SandboxSnapshot|BuildCommitJob)' -count=1
  • go vet ./cmd/image-committer
• Integration tests
  • Built Dockerfile.image-committer; verified the runtime contains nerdctl 2.0.5.
• e2e / manual verification
  • Kind v0.20.0, Kubernetes v1.22.15, containerd v1.6.9.
  • Reproduced the pre-fix egress-sidecar failure four times with content digest ... not found.
  • Re-ran the focused full pause/resume flow with the fixed image: both sandbox and egress snapshots pushed, restore completed, and the rootfs marker survived (1 Passed, 0 Failed).

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (not needed; no API, configuration, or workflow change)
• Added/updated tests
• Security impact considered (registry credentials and image-committer trust model are unchanged)
• Backward compatibility considered (multi-container snapshot semantics are preserved)

[Copilot]

Pull request overview

This PR hardens the Kubernetes image-committer snapshot push path to be platform-safe, addressing snapshot/pause failures when committing/pushing multi-platform–derived sidecar images (issue #1382) by ensuring nerdctl push targets the committer’s explicit runtime platform and by enforcing a nerdctl version with the required content-recovery behavior.

Changes:

• Upgrade the image-committer runtime image to Alpine 3.21 and assert nerdctl v2+ in the runtime container.
• Update image pushing to use nerdctl push --platform <runtime> (plus --insecure-registry when applicable) via a dedicated helper.
• Add a focused unit test validating the constructed nerdctl push arguments include the runtime platform.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
kubernetes/Dockerfile.image-committer	Moves runtime base to Alpine 3.21 and enforces nerdctl v2+ at build time.
kubernetes/cmd/image-committer/main.go	Adds explicit runtime-platform selection to nerdctl push via helper functions.
kubernetes/cmd/image-committer/main_test.go	Adds unit coverage to lock in the expected nerdctl push argument shape and platform selection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.