default is 2 minutes; we're exceeding 85% disk
and so GC was removing prefetched images

node-accessible is disk minus OS/etc (~42GB gke-latest)
GC hits at 85% and evicts images not used in 2 minutes.
Neither the 85% nor the 2 minutes can be increased.

This reverts commit 5aab5eb.

The prefetcher pulls images by tag via the CRI API, which stores them
indexed by tag name. When tests reference the image as
tag@sha256:<manifest-list-digest>, containerd 2.x cannot resolve it
with imagePullPolicy: Never because the manifest list digest is not
indexed as a named image by the CRI pull-by-tag path.

This caused ErrImageNeverPull on every node regardless of disk size,
as the image was present on disk but not findable by digest. Images
referenced by tag only (busybox-1-33-1, nginx-1-12-1, etc.) worked
fine with the same Never pull policy.

Remove the @sha256: digest from TEST_IMAGE so it matches how the
prefetcher stores the image. Keep TEST_IMAGE_SHA available for API
queries that need the digest.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

After the prefetcher completes, deploy a short-lived DaemonSet that
runs ctr on each node to label all prefetched images with
io.cri-containerd.pinned=pinned. This tells kubelet's image GC to
skip these images regardless of disk pressure.

The DaemonSet uses an init container for the actual work and a main
container that exits immediately. The DaemonSet and its ConfigMap are
deleted after completion to avoid leaving pods running.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The previous commit used `apk add containerd-ctr` but the package is
in alpine's community repo which isn't enabled by default. The install
silently failed (stderr redirected to /dev/null), so ctr was never
installed and images were never actually pinned.

Add the community repo URL explicitly via -X flag and remove the
stderr suppression so failures are visible.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…time

Installing containerd-ctr via apk at runtime is too slow (pulls full
containerd package + deps from community repo), causing the 5-minute
rollout timeout to be exceeded.

Use ghcr.io/containerd/containerd:2.0 which ships with ctr already
installed, eliminating the package install step entirely.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Previous attempts to install/provide ctr in the pinning DaemonSet
failed: apk add was too slow, and ghcr.io/containerd/containerd:2.0
was too large to pull within the 5-minute timeout.

Instead, use the image-prefetcher image (already cached on every node
from the prefetch step) with hostPID and nsenter to execute the host's
own ctr binary. This requires no image pull and no package install.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Previous approaches failed because:
- apk add containerd-ctr: too slow (>5min timeout)
- ghcr.io/containerd/containerd:2.0: too large to pull in time
- nsenter via image-prefetcher image: no nsenter/sh available

Use kubectl debug node/ which mounts the host filesystem at /host,
giving access to the host's ctr binary via chroot. No image pull
delays since busybox:1.36 is tiny, and no DaemonSet rollout needed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The previous approach tried to pin images by the tag names from the
prefetch list, but containerd stores multi-arch images under different
references (manifest list digests, platform digests). Only 15-19 of 72
images were found by tag name.

Instead, list ALL images in containerd's k8s.io namespace via
`ctr images list -q` and pin every one. This catches all references
regardless of how containerd indexed them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

kubectl debug with -it requires a TTY which is not available in CI,
causing output capture to silently fail. Remove -it so the command
runs non-interactively and its output is properly captured.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

kubectl debug node/ without -it doesn't execute the command (just
creates the pod and returns). With -it it needs a TTY unavailable in CI.

Instead, use kubectl run with --overrides to create a pod per node with:
- nodeName: targets specific node
- hostPID: true: enables nsenter to enter host namespaces
- nsenter -t 1 -m -u -n -p: runs the host's ctr directly
- busybox:1.36: tiny image (~4MB), has nsenter built in

Pods are launched in parallel, then we kubectl wait for completion
and collect logs. This gives proper output capture and error handling.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

io.cri-containerd.pinned has known bugs (containerd#9328, #10270)
that make it unreliable for preventing image GC.

Replace the pinning approach with a re-pull step: after the prefetcher
completes, run ctr images pull on each node for any images whose tag
reference was lost to GC. Since layers are still cached, re-pulls are
near-instant. Uses the same image list configmap as the prefetcher.

Only re-pulls images that are missing (ctr images check); skips images
that are still present.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Point to the branch-rox-33305-prevent-gc image of image-prefetcher
which pins images via the containerd native API immediately after
each CRI pull, preventing kubelet GC from evicting them.

This replaces the post-hoc repull/pin approaches which all failed due
to various containerd/CRI issues.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>