fix(vminit): close stream connections with process io

Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>

Author: austinvazquez

internal/vminit/process/io.go

@@ -65,15 +65,30 @@ type processIO struct {
 }
 
 func (p *processIO) Close() error {
+	var result []error
 	if p.io != nil {
-		return p.io.Close()
+		if err := p.io.Close(); err != nil {
+			result = append(result, err)
+		}
 	}
+	// Close the stream connections too. For the "stream" scheme both p.io
+	// (the runc pipes) and p.streams (the vsock conns to the host shim) are
+	// set, so closing p.io alone leaves the streams open. On the normal exit
+	// path the copyPipes goroutines close the streams themselves once the
+	// runc pipes EOF, but if the exec process fails to start, copyPipes is
+	// never reached and this Close is the only cleanup. Leaving the streams
+	// open wedges the host shim's IO-shutdown (it waits for an EOF that never
+	// comes) until its 30s timeout fires. Closing here propagates EOF
+	// immediately. Streams already closed by copyPipes return ErrClosed,
+	// which callers ignore.
 	for i, s := range p.streams {
 		if s != nil && (i != 2 || s != p.streams[1]) {
-			s.Close()
+			if err := s.Close(); err != nil {
+				result = append(result, err)
+			}
 		}
 	}
-	return nil
+	return errors.Join(result...)
 }
 
 func (p *processIO) IO() runc.IO {