containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull (CVE-2026-53488) | HOL Guard CVE