Use os.Root for copy operations in vminitd

[dmcgowan]

Updates the transfer in vminitd to use os.Root rather than path resolution into the destination path

[Copilot]

Pull request overview

This PR updates the container filesystem transfer logic in vminitd to anchor copy/export/import operations using os.Root, aiming to prevent path traversal and symlink-escape issues by avoiding destination-path resolution.

Changes:

• Introduces rootRel and migrates writePath to use os.OpenRoot + root.FS() walking and *os.Root file operations.
• Migrates readPath extraction to enforce destination boundaries via a sub-*os.Root, removing prior lexical prefix checks.
• Adds comprehensive tests covering tar path traversal, symlink/hardlink attacks, and round-trip export/import behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
internal/transfer/containerfs.go	Switches export/import implementation to *os.Root-anchored operations and adds rootRel helper.
internal/transfer/containerfs_test.go	Adds security- and correctness-focused tests for export/import behavior (symlinks, traversal, round-trips).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.