fix(containerd): preserve shared imports during cleanup

[git-jxj]

Description

Preserve a shared containerd drop-in import when other matching files remain after removing the NVIDIA runtime. File-loaded installer cleanup currently deletes a top-level config containing only version and that glob, so containerd silently stops loading unrelated drop-ins that are still present on disk.

Inspect the local drop-in directory before removing the import, including when host and container paths differ. Keep the import when the directory cannot be inspected or the output is stdout. NVIDIA-only cleanup still removes the empty configuration; other import patterns and top-level settings retain their existing behavior.

Closes #2134.

Checklist

• No secrets, sensitive information, or unrelated changes
• Unit tests passing (make test, through make coverage in the CPU environment described below)
• Lint checks passing (make lint)
• Test cases are added for new code paths
• Commits are signed-off and cryptographically signed

Testing

• Regression tests fail on the original implementation and pass with the fix. Cover config versions 2 and 3, NVIDIA-only and shared directories, host path mapping, nonmatching files, additional imports/settings, stdout, and an unavailable directory.
• make build, make fmt, make lint, make coverage, make check-vendor, make -C deployments/devel check-modules, and make check-third-party-notices; go test -race ./pkg/config/engine/containerd -count=1. Go 1.27.1; golangci-lint built from v2.13.1 with the same Go version.
• Replayed container.Options.Unconfigure against isolated files and containerd 2.2.1's real config dump parser for versions 2/3 × NVIDIA-only/shared glob/multiple imports/additional settings. Shared settings remain loaded, unrelated drop-in bytes remain identical, and NVIDIA-only cleanup still removes the files.

The full unit suite ran in a private child mount namespace with NVML unavailable, matching a CPU CI environment. On this GPU host, the original main branch also fails four unrelated fixture-dependent packages because it discovers the installed driver. The host's NVML library and parent mount namespace were unchanged after testing. Configuration replay used the actual parser without restarting a containerd daemon; GPU workloads were not exercised.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[git-jxj]

The workflows for current head 128af6acd5557a9daf3cffed3f1e0be4cff00212 are waiting for maintainer approval: Golang, CodeQL. Could a maintainer review this head and approve the pending runs? The jobs have not executed yet.