Live-validation fix for the dark containerd engine (#327). Behind SB_CONTAINER_ENGINE=containerd; docker default path untouched.

A real single-node-containerd integration run surfaced three defects the offline fakes could not:

• netns Host.Realize created a plain directory, not a real network namespace → every CNI ADD failed with a bare exit status 1. Now creates/deletes a real named netns via ip netns add/del.
• cni.ExecRunner swallowed the plugin error (CNI reports failures as JSON on stdout, not stderr).
• Terraform bootstrap never installed the CNI plugin binaries on containerd nodes. bootstrap.sh.tftpl now installs bridge/host-local/loopback (v1.5.1) when the engine is containerd.

The Category-2 boot code was already confirmed correct on hardware (conflist with uplink MTU 9001, br_netfilter, AEROLVM-USER chain + FORWARD jump). This release closes the create-path gap so install.sh --version latest pulls a sandboxd that can actually boot a containerd sandbox. Still dark — the §8 exit gates remain the bar before the default flips.

What's Changed

• fix(containerd): real netns creation + CNI plugin install (live-validated) by @sumansaurabh in #327

Full Changelog: v0.7.2...v0.7.3