Adopt runsc --no-root-container to take sentry startup off the actor start path

gvisor PR for runsc --no-root-container flag: https://github.com/google/gvisor/pull/13981

A new `runsc --no-root-container` flag allows a sandbox with no root container.

Adopting it removes, per actor start and per restore: the pause image pull, the pause bundle, its overlay compose (`SetupBundleRootfs`), and one `runsc create` + `runsc start` round trip. A constant-factor saving on both the cold and hot paths, plus a meaningful amount of special-casing deleted (`"pause"` is hardcoded through `cmd/ateom-gvisor/main.go` and the checkpoint, restore, state, and delete paths).