overlay: userxattr auto-negotation doesn't cover gVisor's filrestore-backed tmpfs upper

cgroup2: Support cgroup.freeze

`posix_spawnp` with `POSIX_SPAWN_SETPGROUP` fails with EPERM under ptrace platform

Terminal reporting not working: 'not a tty'

open_tree(OPEN_TREE_CLONE) succeeds on MNT_DETACH unmounted mount

Implement TIOCGPTPEER ioctl for devpts

support guest Landlock syscalls for in-sandbox application sandboxing

/proc/[pid]/ns/user is not usable with setns

Possible regression in latest runsc release: kaniko writes fail with "operation not supported" on /kaniko/*

--systemd-cgroup silently bypasses Kubernetes CPU limits when CRI emits cgroupfs cgroupsPath (contradicts #12392 guidance)