Review-driven hardening of the dark containerd engine (Phases 2–4, #326, on top of v0.7.1's #325). containerd remains opt-in behind SB_CONTAINER_ENGINE=containerd (default docker); this release does not flip the default and the docker path is byte-identical.

Fixes (all behind the containerd flag)

• Idempotency: a retry / concurrent-duplicate Create no longer tears down the live winner's netns; image-lease + park-netns-slot leaks closed; snapshot pause no longer marks the sandbox stopped.
• Networking: EnsureChain fails loud instead of silently latching on the netlink backend; netlink nftables chain + FORWARD-jump bootstrap with a re-assert ticker; CNI ExecRunner now speaks the real exec protocol; bridge conflist generated at boot with uplink MTU + ipMasq; br_netfilter load+verify; conntrack flush both directions.
• Snapshot: CreateSnapshot assembles a real OCI manifest (was a non-runnable diff descriptor).
• Push: idempotent on AlreadyExists; credentials scoped to one registry host.
• Coverage restored to the bar on the touched packages; new SB_CONTAINERD_* flags documented.

Not yet live-verified

The containerd host realization (CNI, nftables, br_netfilter, conntrack, snapshot content-store round trip) is unit-tested against fakes but validated on real hardware only by the containerd integration suite; the plans/containerd-engine.md §8 exit gates remain the bar before the engine is made default.

What's Changed

• fix(containerd): review fixes for Phases 2–4 (idempotency, networking, snapshot) — dark by @sumansaurabh in #326

Full Changelog: v0.7.1...v0.7.2