Use FilePath for ContainerResource.Bundle

[chrisgeo]

Summary

• Converts ContainerResource.Bundle from URL to SystemPackage.FilePath across 9 path references.
• Sibling of Use FilePath for SnapshotStore #25 (SnapshotStore) and merged Switch NetworksService, VolumesService, EntityStore to FilePath. apple/container#1493 (NetworksService/VolumesService/EntityStore), same migration pattern.

Public API delta

Member	Before	After
Bundle.path	URL	FilePath
Bundle.init(path:)	URL	FilePath
Bundle.bootlog	URL	FilePath
Bundle.containerRootfsBlock	URL	FilePath
Bundle.filePath(for:)	-> URL	-> FilePath
Bundle.create(path:…)	URL	FilePath
Bundle.containerLog (in ContainerSandboxServiceClient)	URL	FilePath

containerRootfsConfig (internal accessor) follows.

Caller sites updated

• Sources/Services/ContainerAPIService/Server/Containers/ContainersService.swift — 7 sites: lines 122, 791-794, 924-926, 962, 1065, 1109, 1168.
• Sources/Services/ContainerSandboxService/Server/SandboxService.swift — 6 sites: 156, 206, 248, 1236, 1451, 1465.

Bundle+Log.swift extension also migrated (containerLog: URL -> FilePath).

URL boundaries preserved (with reason)

All Foundation APIs that only accept URL get a localized bridge with a one-line comment justifying the leak:

• Sources/ContainerResource/Container/Bundle.swift:53 — Data(contentsOf:) for containerRootfs getter.
• Sources/ContainerResource/Container/Bundle.swift:93,95 — FileManager.copyItem(at:to:) and Kernel.path (Containerization API still URL).
• Sources/ContainerResource/Container/Bundle.swift:144 — Data.write(to:) for setContainerRootFs.
• Sources/ContainerResource/Container/Bundle.swift:170 — Data.write(to:) (private static write).
• Sources/ContainerResource/Container/Bundle.swift:178 — Data(contentsOf:) (private load).
• Sources/Services/ContainerAPIService/Server/Containers/ContainersService.swift:793-794 — FileHandle(forReadingFrom:) for container log + bootlog.
• Sources/Services/ContainerSandboxService/Server/SandboxService.swift:206 — FileHandle(forWritingTo:) for container log.
• Sources/Services/ContainerSandboxService/Server/SandboxService.swift:248 — BootLog.file(path: URL, append: Bool) is a Containerization API still URL.
• Sources/Services/ContainerSandboxService/Server/SandboxService.swift:1465 — RuntimeConfiguration.path is still URL (out of scope, separate ticket).
• Sources/Services/ContainerSandboxService/Server/SandboxService.swift:156, 1451, ContainersService.swift:122, 791, 924, 962, 1065, 1109, 1168 — call sites where containerRoot/self.root/dir are still URL (private fields, out of scope) bridged via FilePath(url.path) at Bundle construction.

Test plan

• swift build succeeds with no warnings.
• swift test --filter ContainerResource — 36/36 pass.
• swift test --filter ContainerAPIService — 2/2 pass (RuntimeConfigurationTests).
• swift test --filter ContainerSandboxService — no dedicated unit tests target this module.
• lsp_diagnostics clean on all 4 changed files.

Closes CHAOS-1460. Part of CHAOS-1448 epic. Unblocks CHAOS-1467 (server-side catch-all).

[linear]

CHAOS-1460

CHAOS-1448