crio: add retry to ContainerInfo call

[Chandan9112]

Summary

When cadvisor detects a new container cgroup via inotify, the container may not yet be fully registered in CRI-O. This race condition causes ContainerInfo to return HTTP 404, which cadvisor treats as a fatal error and logs:

Failed to process watch event: Error finding container <id>: Status 404 returned error can't find the container with id <id>

This is the same race condition that the containerd handler already handles with a retry+backoff loop around TaskPid (lib/container/containerd/handler.go, lines 94-118).

Root Cause

1. cadvisor watches for new cgroups via inotify
2. CRI-O creates the container cgroup early during container setup
3. cadvisor sees the cgroup and immediately calls CRI-O's /containers/<id> API
4. CRI-O has not yet finished registering the container internally → returns HTTP 404
5. cadvisor logs this as a warning and fails to track the container

The race window is widened in environments using GPG-signed container images, where signature verification delays CRI-O's container registration.

Fix

• Add an ErrContainerNotFound sentinel error in client.go
• Wrap HTTP 404 responses from CRI-O's ContainerInfo with the sentinel (using %w)
• Add a retry loop with exponential backoff (5 retries, 100ms initial, doubling) in handler.go's newCrioContainerHandler, mirroring the existing containerd handler pattern
• Non-404 errors fail immediately without retry
• Added klog.V(4) logging for observability during retries

Prior Work

Supersedes #3842 by @haircommander, which addressed the same issue but was closed as stale. This PR reimplements the same approach with the following improvements:

• Exported ErrContainerNotFound sentinel (vs unexported errNotFound)
• Fixed format string bug in error wrapping
• Added klog.V(4) retry logging for observability

cc @haircommander

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Chandan9112]

@googlebot I signed it.

[haircommander]

I don't know if we need a unit test for this, it's just testing behavior golang should test with fmt.Errorf

[Chandan9112]

Yes correct Peter, removed in the latest commit. Will make it ready for review.