Generalize startup-local image startup acceleration

[jwcesign]

Summary

This PR replaces the OpenSearch/JVM-specific startup acceleration profile with a generic internal startup-local-v1 profile while keeping the public HermesPolicy/API shape unchanged.

Key changes:

• generic startup prefetch path generation from OCI image config (Entrypoint, Cmd, WorkingDir, PATH) plus common runtime/system paths
• internal SOCI annotation for the normalized startup path patterns so the daemon can materialize the same image-specific file set it prefetched
• generic daemon materialization classifier for runtime bundles, archives, shared libraries, executables, config, certs, and timezone/NSS files
• resolve fallback from accelerated artifact key to default artifact key for API compatibility
• tests updated away from OpenSearch/JVM fixtures and toward generic app layouts

EKS E2E

Result root:
/Users/jwcesign/git/cloudpilot/examples/clusters/eks-spot/out/eks-opensearch-generic-20260621151818

Workload and control:

• OpenSearch 2.19.1 linux/amd64, same image digest
• same EKS cluster, same Karpenter pools, fresh node per run
• startupfirst uses this branch's controller image and daemon tarball
• overlay uses standard AL2023/containerd overlayfs
• 10 runs per variant, all benchmark_valid=true, image digest verified, image pull failures=0

Main metric:

• scheduled -> HTTP 200 mean: startupfirst 30.444s vs overlay 38.179s
• delta: 7.735s faster, 20.26% reduction, 1.254x speedup

Additional metrics:

• scheduled -> Ready mean: startupfirst 30.400s vs overlay 38.200s, 20.42% reduction
• image pull message duration mean: startupfirst 2.875s vs overlay 19.789s, 85.47% reduction
• container started status mean: startupfirst 3.700s vs overlay 20.700s, 82.13% reduction
• create -> HTTP 200 mean: startupfirst 61.544s vs overlay 66.879s, 7.98% reduction

Validation

• git diff --check
• rg -n "buildProfileOpenSearch|openSearchPrefetch|opensearch-jvm|OpenSearch|opensearch|JVM|jvm|java|jdk" pkg returns no matches
• Linux targeted unit tests:
  go test ./pkg/controller ./pkg/common/soci ./pkg/daemon/fs ./pkg/daemon/fs/layer ./pkg/daemon/fs/reader ./pkg/daemon/fs/spanmanager ./pkg/daemon/snapshot
• Linux full unit tests:
  go test ./...
• EKS 10x startupfirst vs overlay end-to-end HTTP 200 benchmark

Review Notes

Self-review focus:

• public CRD/API remains unchanged
• artifact identity remains profile/version/knob based; image-specific patterns come from immutable image config and are stored in the generated internal artifact
• daemon materialization consumes internal pattern annotations first and only falls back to generic classification for older artifacts
• resolve keeps accelerated artifacts preferred but falls back to default artifacts to preserve existing behavior

[gitautomator]

Thanks to your contribution, the maintainers will review it as soon as they can!