nerdctl run can't use the CimFS snapshotter on Windows (ctr can)

### Summary
`nerdctl --snapshotter cimfs run …` fails on Windows even though `ctr --snapshotter cimfs run …` works against the same containerd. nerdctl host-mounts the image rootfs during `run` setup, and containerd's Windows mount helper only supports `windows-layer` mounts.

### Repro
Windows 11 25H2 (build 26200), containerd v2.3.1 configured with the `cimfs` differ/unpack_config (so pulls unpack fine):

```
nerdctl --snapshotter cimfs pull mcr.microsoft.com/windows/nanoserver:ltsc2025 # OK
nerdctl --snapshotter cimfs run --rm mcr.microsoft.com/windows/nanoserver:ltsc2025 cmd /c "echo ok"
# FATA[...] invalid windows mount type: 'CimFS'
```
The same image runs fine via `ctr --snapshotter cimfs run …`.

### Cause
`generateMountOpts` (`pkg/cmd/container/run_mount.go`) always takes a `snapshotter.View` of the image rootfs and host-mounts it to a temp dir — `mount.All(mounts, tempDir)` on Windows — to seed image-`VOLUME` / anonymous-volume contents. For a `cimfs` snapshot the mount type is `CimFS`, and containerd's `core/mount/mount_windows.go` `Mount.mount()` rejects anything that isn't `windows-layer`:
```go
if m.Type != "windows-layer" {
return fmt.Errorf("invalid windows mount type: '%s'", m.Type)
}
```
`ctr run` doesn't do this pre-mount (it hands the snapshot mounts straight to the runhcs shim, which mounts CimFS natively), which is why it works.

### Possible fixes
- **nerdctl**: skip the `View` + `mount.All` pre-mount when there's nothing to seed (image declares no `VOLUME`s and no `-v`/`--mount` volume copies) — makes the common case (e.g. nanoserver) work immediately. There's already a `MountManager().Activate` step here that tolerates `ErrNotImplemented`; the fallback `mount.All` is what fails.
- **containerd** (root fix, benefits everyone): teach `core/mount/mount_windows.go` to host-mount CimFS/BlockCIM snapshots read-only. Then images with real `VOLUME`s work too. Both repos are in the containerd org.

### Context
containerd fully supports CimFS on GA Windows (25H2); the daemon-side wiring gap is tracked at containerd/containerd#13782 and the Docker Engine side at moby/moby#53063.

Start in pkg/cmd/container/run_mount.go at generateMountOpts, then trace MountManager().Activate and the mount.All(mounts, tempDir) fallback used during nerdctl run setup. Reproduce the CimFS command on Windows and compare the no-VOLUME path with image VOLUME or volume-copy cases; done means CimFS images can run without regressing volume-content seeding.

Written by the indexing model from the issue text.