storage: fix UID/GID map handling for shifting layers

when the driver supports shifting, set the rechown target to identity
instead of the container's maps.

Closes: https://redhat.atlassian.net/browse/RHEL-160859

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Author: giuseppe

storage/layers.go

@@ -1649,6 +1649,9 @@ func (r *layerStore) create(id string, parentLayer *Layer, names []string, mount
 	}
 
 	idMappings := idtools.NewIDMappingsFromMaps(moreOptions.IDMappingOptions.UIDMap, moreOptions.IDMappingOptions.GIDMap)
+	if moreOptions.IDMappingOptions.HostUIDMapping && moreOptions.IDMappingOptions.HostGIDMapping {
+		idMappings = &idtools.IDMappings{}
+	}
 	opts := drivers.CreateOpts{
 		MountLabel: mountLabel,
 		StorageOpt: options,

storage/store.go

@@ -2042,9 +2042,10 @@ func (s *store) CreateContainer(id string, names []string, image, layer, metadat
 		// But in transient store mode, all container layers are volatile.
 		Volatile: options.Volatile || s.transientStore,
 	}
+	useHostMapping := idMappingsOptions.HostUIDMapping || s.canUseShifting(uidMap, gidMap)
 	layerOptions.IDMappingOptions = LayerIDMappingOptions{
-		HostUIDMapping: idMappingsOptions.HostUIDMapping,
-		HostGIDMapping: idMappingsOptions.HostGIDMapping,
+		HostUIDMapping: useHostMapping,
+		HostGIDMapping: useHostMapping,
 		UIDMap:         copySlicePreferringNil(uidMap),
 		GIDMap:         copySlicePreferringNil(gidMap),
 	}