cgroup: add BPF probe for v1 fallback and improve GCS error diagnostic

[jiechen0826]

Problem

On Yocto kernels (e.g. 6.1.153.1-microsoft-standard), the kernel supports the cgroup2 filesystem but lacks CONFIG_CGROUP_BPF. When init mounts cgroup v2 and finds controllers, it commits to v2. Later, runc tries BPF_PROG_QUERY on BPF_CGROUP_DEVICE and gets ENOSYS, causing container creation to fail.

Separately, on ARM kernels with CONFIG_MEMCG_V1 disabled (e.g. 6.18+), the GCS crashes with a generic error when the v1 memory controller is absent, making it hard to diagnose.

On Ubuntu 6.17 kernels, the vsock read() in init_entropy() returns ENOMEM after hv_sock module load when transport buffers are not yet initialized. Since init runs as PID 1, the die() call triggers a kernel panic, preventing the UVM from booting.

Fix

init.c (commit 1): Before committing to cgroup v2, probe BPF cgroup support by issuing BPF_PROG_QUERY with attach_type = BPF_CGROUP_DEVICE on the cgroup root fd. If the kernel returns ENOSYS or EINVAL (no BPF support), unmount cgroup2 and fall back to v1. Also add a mounted counter in init_cgroups_v1() to die cleanly when no v1 controllers are available, and add hcsshim.cgroup=v1 kernel parameter to force v1.

main.go (commit 1): Improve the fatal error message when the v1 memory controller is absent to point at CONFIG_MEMCG_V1 and the cgroup v2 + CONFIG_CGROUP_BPF alternative.

init.c (commit 2): Make entropy seeding non-fatal by replacing die() with warn() + dmesgWarn() + early return/break. The UVM can function without entropy seeding.

Testing

• Azure Linux kernel (6.14.0): BPF probe succeeds, cgroup v2 used, LCOW smoke test passes
• Yocto kernel (6.1.153.1-microsoft-standard): init detects ENOSYS from BPF probe, falls back to v1, LCOW smoke test passes
• Ubuntu kernel (6.17.0-1008-azure): BPF probe succeeds, cgroup v2 used, entropy warning logged but UVM boots, sandbox creation succeeds
• Verified entropy fix is required: without it, Ubuntu 6.17 fails with failed to connect to entropy socket: context deadline exceeded