atelet doesn't emit runtime-neutral OCI specs

[eliranw]

Problem

buildActorOCISpec currently generates OCI specs tightly coupled to the runsc runtime. Specifically, it emits:

• Hardcoded Hostname: "runsc"
• CRI pause/sandbox primitives (container-type=sandbox for the pause container; container-type=container / sandbox-id=pause for app containers)
• Proprietary annotations (dev.gvisor.spec.mount.durabledir.*)

Because of this, ateom-microvm is forced to silently rewrite every micro-VM actor spec at runtime using ensureKataCompatibleSpec (cmd/ateom-microvm/spec.go), which injects linux.resources, strips io.kubernetes.cri.*, and swaps the mount set.

Impact

MicroVM is a first-class runtime (SandboxClass=microvm), so relying on this runtime shim introduces drift and subtle production bugs:

• Behavioral divergence: the shim silently drops the /run/ate/actor-id identity mount for microVM actors, creating real functional divergence from gVisor.
• Fragility: each new OCI spec field or annotation added to atelet risks silently breaking microVM actors until ensureKataCompatibleSpec is manually updated to handle it.

Proposed solution

• Refactor atelet to emit a runtime-neutral base spec.
• Move per-runtime spec shaping into each ateom implementation (or a shared converter module keyed on SandboxClass).
• Remove ensureKataCompatibleSpec entirely, resolving the TODO in cmd/ateom-microvm/spec.go.

Acceptance criteria

• microVM actors receive their /run/ate/actor-id identity mount (divergence closed).
• No runsc / io.kubernetes.cri.* / dev.gvisor.* literals appear in atelet's spec output.
• A parity test asserts both runtimes accept atelet's emitted spec without runtime rewriting.