Preserve unloadable bundles and write metadata atomically

[stephenlclarke]

During testing of my Container Compose plugin, I found that startup load failures can delete complete container bundles and, when a runtime plugin is missing, still publish an unusable in-memory state for the deleted bundle.

This supersedes and credits @radheradhe01's work in #1859. That PR correctly preserves failed bundles and makes the generic bundle writer atomic. This version retains those fixes and strengthens them by:

• validating runtime availability before inserting ContainerState;
• making rootfs.json writes atomic as well as metadata written through the generic bundle writer; and
• adding corrected regressions that exercise both malformed current and legacy configuration files.

Fixes #2033.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Motivation and Context

ContainersService.loadAtBoot currently removes a bundle directory for every load error. Some failures are transient, such as a runtime plugin not being registered when startup loading runs, while malformed metadata should remain available for diagnosis or recovery.

The missing-runtime path also constructs and inserts a stopped ContainerState before checking for the plugin. The subsequent error deletes the bundle, but the returned dictionary still exposes the state as a usable container.

Bundle JSON is currently written directly to its destination. An interrupted write can therefore expose truncated metadata on the next startup, which then reaches the destructive load-error path. rootfs.json uses a separate writer and must receive the same atomic replacement semantics.

Reproduction on stock main

Tested at 48145ac7fb177d9fb14e015a0bdea4c642b36729.

1. Put malformed JSON in both config.json and the legacy fallback runtime-configuration.json.
2. Call ContainersService.loadAtBoot.
3. Observe that the bundle directory is deleted.
4. Separately, create a valid bundle whose configured runtime plugin is unavailable.
5. Call loadAtBoot again.
6. Observe that the bundle is deleted while the returned state dictionary still contains the container.

The corrected regression suite fails on stock main with four issues:

• the malformed bundle no longer exists;
• the missing-runtime state dictionary is not empty;
• the missing-runtime bundle no longer exists; and
• reloading its deleted config.json fails with NSCocoaErrorDomain Code=260.

Expected behaviour

Failed bundles remain on disk, no state is inserted until runtime availability is validated, and all bundle metadata files are replaced atomically.

Testing

• Tested locally

• Added/updated tests

• Added/updated docs

• make check: passed

• swift test --filter ContainerLoadAtBootTests: 2 tests in 1 suite passed in 0.006 seconds, 201.58 seconds including the initial dependency build

• make test: 591 tests in 72 suites passed in 2.011 seconds, 119.33 seconds including the Apple test build

• Strict-review focused rerun: swift test --filter ContainerLoadAtBootTests passed 2 tests in 1 suite in 0.006 seconds, 95.93 seconds including a clean rebuild

• Two fresh strict-review full-suite retries passed the persistence coverage, then stopped on the unrelated stock DirectoryWatcherTest readiness races corrected by Close directory watcher descriptors after failed startup #2036 (testWatchingNonExistingDirectory, then testWatchingNonExistingParent)

• Stock main negative control: the same 2 tests failed with the four expected issues in 0.016 seconds, 94.56 seconds including rebuild

• git diff --check: passed

All commits are signed and verified.