docs(box): CRI conformance 42 pass / 40 fail (regression re-run at 04a0969)

Authoritative full critest re-run after the session's 8 commits: 42 Passed
/ 40 Failed / 15 Skipped, no regressions. Updates the scoreboard — seccomp
RuntimeDefault and safe sysctls now pass; remaining seccomp gap is
localhost profiles only, remaining sysctls gap is unsafe (fs.mqueue,
guest-kernel). All 40 failures are registry-egress / guest-kernel /
architectural / test-image artifacts.

Author: Roy Lin

docs/cri-conformance.md

@@ -17,12 +17,13 @@ suite so regressions are visible and progress is measurable.
 | `critest` | v1.30.1 |
 | a3s-box | 2.0.5 (+ unreleased CRI maturity work, heading to 2.0.6) |
 | Host | Linux KVM node (`/dev/kvm`), Ubuntu 24.04 |
-| Result | **38 Passed · 44 Failed · 15 Skipped** (ran 82 of 97 specs, ~17 min) |
+| Result | **42 Passed · 40 Failed · 15 Skipped** (ran 82 of 97 specs, ~18 min) |
 
 This is up from the original **21 Passed / 59 Failed** baseline (2.0.4): streaming
-exec/attach, container logs + reopen, and most of the Linux SecurityContext now
-pass. Several remaining "failures" are **test-environment artifacts**, not runtime
-defects (see below).
+exec/attach, container logs + reopen, force-RemoveContainer, safe sysctls,
+RuntimeDefault seccomp, and most of the Linux SecurityContext now pass. The
+remaining 40 failures are **all** registry-egress / guest-kernel / architectural
+/ test-image artifacts — none is a logic defect (see below).
 
 How it was run:
 
@@ -45,7 +46,7 @@ critest --runtime-endpoint unix:///tmp/a3s-box.sock \
 > `defaultTestContainerImage` + `webServerImage` are overridable via the images
 > file, so these pulls cannot be redirected to the mirror.
 
-## What passes (38)
+## What passes (42)
 
 - **Pod + container lifecycle:** `RunPodSandbox` (boots a microVM),
   `PodSandboxStatus`, `CreateContainer`, `StartContainer`, `ContainerStatus`,
@@ -57,8 +58,10 @@ critest --runtime-endpoint unix:///tmp/a3s-box.sock \
 - **Container logs:** writing to `log_path` and `ReopenContainerLog` (rotation).
 - **Linux SecurityContext:** `RunAsUser`, `RunAsGroup`, `RunAsUserName`
   (passwd lookup), reject `RunAsGroup` without `RunAsUser`, `SupplementalGroups`,
-  `ReadonlyPaths`, seccomp `unconfined`/nil. `/proc` + `/sys` are mounted inside
-  the container chroot.
+  `ReadonlyPaths`, seccomp `unconfined`/nil/**RuntimeDefault** (default BPF
+  filter → `Seccomp: 2`). `/proc` + `/sys` are mounted inside the container
+  chroot.
+- **Pod sysctls:** safe sysctls applied at VM boot (`/proc/sys` writes).
 - Basic `ImageStatus`/`ListImages`.
 
 ## Real gaps (failures grouped by cause)
@@ -67,8 +70,8 @@ critest --runtime-endpoint unix:///tmp/a3s-box.sock \
 |----------|--------------------------|------------|---------------|
 | **Registry egress** (~22) | Multiple-Containers exec/log/network, image pull/list/status, DNS, port-mapping, port-forward, HostNetwork/PID/IPC, Privileged, ReadOnlyRootfs, NoNewPrivs, image-group SupplementalGroups | webserver/helper images on `registry.k8s.io`/`gcr.io` are unreachable and not overridable via the images file | ❌ environmental |
 | **Writable volume mounts** (~6) | starting container with volume (+ host-path symlink), mount propagation rshared/rslave/rprivate, non-recursive readonly mounts | only read-only mounts (materialized by copy) are supported; writable host-path volumes need a virtio-fs share into the VM, which libkrun configures at boot (containers are created post-boot) | ⚠️ architectural |
-| **seccomp filters** (~3) | seccomp `RuntimeDefault` (wants `Seccomp: 2`), localhost profile, SYS_ADMIN-block | no BPF seccomp filter is installed in the guest child | ✅ guest feature |
-| **sysctls** (~2) | safe/unsafe sysctls | pod sysctls not applied in the guest (`/proc/sys` writes) | ✅ guest feature |
+| **seccomp localhost profiles** (2) | localhost profile, SYS_ADMIN-block | RuntimeDefault now installs the default BPF filter (`Seccomp: 2`); localhost profiles need the host profile file plumbed into the VM + compiled | ⚠️ host-file plumbing |
+| **unsafe sysctls** (1) | `fs.mqueue.msg_max` | safe sysctls are applied (`/proc/sys` writes); the guest kernel lacks `CONFIG_POSIX_MQUEUE` so `/proc/sys/fs/mqueue/` is absent | ❌ guest-kernel |
 | **AppArmor** (~2) | unloaded profile, profile blocking writes | LSM not wired in the guest | ✅ guest feature |
 | **Capabilities** (~3) | add/drop capability, drop ALL | capabilities not managed per-container; `brctl` bridge test also needs a `CONFIG_BRIDGE` guest kernel | ⚠️ murky / possibly kernel-limited |
 | **MaskedPaths** (1) | mask `/bin/ls` | masking code is correct, but under the alpine/busybox substitution `/bin/ls` and `/bin/sh` are the same `busybox` binary, so masking `ls` breaks `sh`; the expected stderr needs `sh` to run | ❌ test-image artifact |