feat: add nerdctl Compose runner with stargz support

[kvinwang]

Summary

• add a measured nerdctl-compose app runner, separate from the existing docker-compose runner
• allow nerdctl-compose to select overlayfs (default) or stargz; reject snapshotter configuration for other runners
• package nerdctl, CNI plugins, and stargz-snapshotter in the guest OS and persist the stargz cache
• pre-register eStargz Compose images with ctr-remote rpull, including Docker-config registry credentials, before starting them with nerdctl
• expose --runner and --snapshotter on dstack deploy and update Rust/Go/Python/JS compose-hash types
• require manifest v3 and pre-built images for the new runner, and document usage and compatibility constraints

Example

dstack deploy -c docker-compose.yaml \
  --runner nerdctl-compose \
  --snapshotter stargz

Validation

• cargo check -p dstack-types -p dstack-util -p dstack-cli-core -p dstack-cli

• targeted Rust tests for manifest version, snapshotter validation, parsing, and manifest generation

• Python compose-hash tests: 16 passed

• JavaScript compose-hash tests: 31 passed

• Go SDK compile-only test

• shell syntax checks for guest boot scripts

• mocked end-to-end dispatch test verifying ctr-remote rpull and nerdctl compose --pull never

• BitBake parsed 10,095 recipes with zero errors

• bitbake -c fetch stargz-snapshotter succeeded (including release checksum validation)

• bitbake mc:prod:dstack-rootfs succeeded (6,775 tasks)

• reproducibility verified across three rootfs emissions: CPIO, squashfs, and squashfs.verity hashes are byte-identical

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[kvinwang]

Addressed the two pending review notes in 6f16c96f:

1. The containerd stargz proxy configuration is now packaged in the image by a versioned containerd-config recipe; boot no longer generates or mutates /etc/containerd/config.toml.
2. The image enumeration/private-registry authentication/ctr-remote rpull logic was extracted from app-compose.sh into the focused nerdctl-compose-pull.sh helper.

Yocto validation after the changes:

• bitbake stargz-snapshotter: succeeded (2,195 tasks)
• clean rebuild of all three stargz RPMs produced byte-identical SHA256 hashes
• bitbake mc:prod:dstack-rootfs: succeeded (6,775 tasks)
• three independently emitted rootfs artifacts were byte-identical despite different output timestamps:
  • CPIO: 57ef4c979cb79ac6f427f0f114245863b16d117954140c223f037141db19ea53
  • squashfs: cd1c07e79d47d2b260bfd342b5db35211f785e40c0ca632fb53816bae7b0c489
  • squashfs.verity: 251d5906eb151167761da9a228b9f4dee7ddbbcd90530c6b0ac5556ff91711fc
• inspected the resulting squashfs and confirmed the packaged containerd config plus nerdctl, ctr-remote, containerd-stargz-grpc, and nerdctl-compose-pull.sh
• all prek hooks pass