Arbitrary image pinning support (i.e. to exclude from kubelet's image GC)

When containerd-snapshotter is configured, ctr can access docker image list by --namespace moby:

└─$ sudo ctr --namespace moby images ls
REF                                                                                                                  TYPE                                                      DIGEST                                                                  SIZE      PLATFORMS                                                                       LABELS                                 
docker.private/ci-abcde                                application/vnd.oci.image.index.v1+json                   sha256:95920585adb12563ed245745d12766fb1f33d74514a07fbb129c00d830fa9507 2.7 GiB   linux/amd64                                                                     io.cri-containerd.pinned=pinned

└─$ sudo k3s crictl images -o json | jq '.images[] | {repoTags,id,pinned}'
{
  "repoTags": [
    "docker.private/ci-abcde"
  ],
  "id": "sha256:95920585adb12563ed245745d12766fb1f33d74514a07fbb129c00d830fa9507",
  "pinned": false
}

According to https://github.com/containerd/containerd/issues/6930 , io.cri-containerd.pinned=pinned label should cause cri to recognize the image is pinned, but it does not.

After checking with Claude, most likely that cri-dockerd does not have the feature to read that label. So, could you add that?

Start by tracing cri-dockerd's CRI image-listing and image-pinning handling, using the reported ctr label and crictl JSON as the reproduction. Check existing image-related tests before making changes. Done means images labeled io.cri-containerd.pinned=pinned are reported as pinned and excluded from kubelet image garbage collection.