Enabling Checkpoint/Restore of Rootless Containers

CRIU currently supports unprivileged checkpoint/restore in limited cases, but rootless containers remain unsupported because they introduce additional challenges around user namespaces, ptrace permissions, seccomp suspension, cgroup handling, and UID/GID mapping. This project aims to add a dedicated rootless-container checkpoint/restore path to CRIU rather than extending the existing --unprivileged mode. The implementation will introduce a user-namespace-aware helper architecture for dump, preserve cgroup state when delegation permits it, correctly capture and restore UID/GID mappings using newuidmap and newgidmap, and establish proper restore ordering for user and mount namespaces. Deliverables include the new rootless-container support path in CRIU, cgroup handling improvements, UID/GID mapping support, expanded rootless zdtm coverage, and documentation for the workflow and limitations.