chore: migrate from containerd v1 to containerd/v2

[shano]

Background

govulncheck CI is permanently broken for any PR touching deps because github.com/containerd/containerd v1.x is affected by 3 CVEs with no v1.x fix:

Vuln ID	CVE	Status
GO-2026-5622	CVE-2026-53489	Fixed in containerd/v2 only (≥2.1.9)
GO-2026-5338	CVE-2026-50195	Fixed in containerd/v2 only (≥2.1.9)
GO-2026-5064	CVE-2026-53492	Fixed in containerd/v2 only (≥2.1.9)

Additionally GO-2026-5709 (crossplane v1.x, GHSA-wfqx-gjrf-g28r) has no v1.x fix — this may need separate assessment.

PR #250 was raised to bump containerd to v1.7.33 but was closed because v1.7.x remains permanently vulnerable to these three CVEs.

What's needed

Migrate the import path from:

github.com/containerd/containerd v1.x

to:

github.com/containerd/containerd/v2 v2.1.9+ (or v2.2.5+ / v2.3.2+)

This is a breaking import path change — all files importing github.com/containerd/containerd need updating.

Impact

Until this is done, govulncheck will fail on every CI run that touches these packages. Dependabot will not auto-raise a fix PR since there is no patched v1.x release.