Support containerd embedded

**Describe the solution you'd like:**

containerd can be embedded into another application. We could consider publishing a version of flintlock with containerd embedded instead of requiring it to be installed already.

This could be a different binary, perhaps **flintlockd-ctr**

**Why do you want this feature:**

**Anything else you would like to add:**
[Miscellaneous information that will assist in solving the issue.]

The issue does not name files, tests, or an entry point. Start by mapping how flintlock currently locates and starts containerd, then determine the packaging and binary boundaries needed for an embedded-containerd variant; done means a separate binary can operate without a preinstalled containerd.

Written by the indexing model from the issue text.