Expose standalone read-only erofs image mounts or mount specs for container snapshotters

I am working on a containerd snapshotter using composefs and found a gap in the cfsctl mount API, both CLI and varlink.

IIUC, the current API creates a complete composefs mount: an overlayfs mount combining the erofs image with the repo objects directory. For writable mounts, the caller provides upperdir and workdir, while composefs-rs assembles the lower side.

A containerd snapshotter needs one level lower: a standalone, read-only erofs mount of the composefs image, without mounting the objects directory or creating the final overlayfs mount.

The snapshotter needs this because:

1. It must assemble the complete overlay lower stack itself, including committed snapshots, Docker’s init layer, or other runtime-specific lowers.

2. It normally returns mount specifications, while the mounts are performed later by the containerd engine in the target mount namespace.

3. The image-level erofs mount should be reusable across multiple per-container overlays.

container-libs follows a similar model: it mounts the composefs erofs blob separately and later includes it in the final overlay.

The containerd erofs snapshotter also follows similar pattern: it returns erofs mount specs followed by the final overlay mount spec. Also, this flow is described in the snapshotter's doc.

I see two possible API shapes:

1. Open and verify the composefs image and return a detached, read-only erofs mount of the image only.
2. Return the resolved and verified image information needed to construct a containerd erofs mount spec, including the image source and verity requirements.

Since the varlink API is being stabilized in #322, it may be worth considering this request there as well.