feat(shell): add nano and crictl to the shell image

[Quang Nguyen (nddq)]

Description

retina shell ships no text editor and no tool to inspect the node's containers from the runtime's point of view. This PR adds two packages from the Azure Linux 3.0 base repo, the same tier every other package in the image comes from. Both are published for amd64 and aarch64.

• cri-tools: provides crictl. It needs no extra capabilities — --mount-host-filesystem already mounts the host's /run, so the containerd socket is present in the container. The image ships an /etc/crictl.yaml that points at the containerd socket. Clusters on another CRI implementation override it with crictl --runtime-endpoint. Without --mount-host-filesystem the socket is absent and crictl is inert, so the package grants nothing the flag did not already grant. The install layer removes critest, a CRI conformance suite binary as large as crictl itself and with no use in a debug shell. The image also ships a symlink from /var/log/pods to /host/var/log/pods — crictl logs opens the kubelet's log files itself, and they exist only on the host. The read-only /host mount covers the read, and the link dangles harmlessly when the flag is not set.
• nano: lets you edit a config or scratch file inside the shell.
• Docs: docs/06-Troubleshooting/shell.md gets a crictl section and names nano in the tool list. It documents that the host's /run mount is always read-write — pre-existing behavior from shell/manifests.go, only documented here.

nano over vim is deliberate. trivy.yaml scans retina-shell weekly on CRITICAL,HIGH. nano has 4 CVEs since 2010, none rated HIGH or CRITICAL. vim has 250, and Azure Linux bumps it for a CVE roughly every 12 days. Between releases, that parks HIGH findings in the scan that nobody can close without a release.

Related Issue

Supersedes #2705 — same change, reopened from an in-repo branch.

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable. (N/A — package addition, no test surface.)

Screenshots (if applicable) or Testing Completed

Image built locally for amd64 and tested on a kind cluster (containerd v2.3.1). The test pod mirrors the --mount-host-filesystem spec from shell/manifests.go: host / read-only at /host, host /run at /run, and no added capabilities.

• crictl version, crictl pods, crictl ps, and crictl inspect work against the live runtime with only the shipped /etc/crictl.yaml — no endpoint flags.
• crictl logs returns the container's log lines out of the box, through the baked-in symlink and the read-only /host mount.
• nano 6.4 and crictl 1.32.0 run in the built image; critest is absent.
• Image size: 1.43GB → 1.48GB unpacked (+50MB). markdownlint-cli2 reports 0 issues on the changed doc.

Additional Notes

Two stale entries in the doc's Limitations section (bpftrace, nsenter) are left alone to keep this PR focused.

[github-actions]

Retina Code Coverage Report

Total coverage no change

Increased diff

Impacted Files	Coverage
pkg/controllers/daemon/namespace/namespace_controller.go	76.24% ... 78.46% (2.22%)	⬆️