Container logs

Container stdout and stderr use Kubernetes’ CRI log format. Each record preserves its RFC 3339 timestamp, stream (stdout or stderr), and full or partial tag. Log paths stay beneath the pod log directory supplied by kubelet; absolute paths and parent traversal are rejected. Reopen requests switch the runtime to the kubelet-rotated active file without inventing a second log location.