fix(kill): do not mark non-stop signals as an explicit stop

[somaz94]

nerdctl kill set containerd.io/restart.explicitly-stopped before sending
any signal, so nerdctl kill --signal HUP on a --restart=always container
permanently suppressed its restart policy. Nothing reported it: the container
kept running and looked healthy.

The label is now set only when the signal is expected to stop the container:
SIGKILL, or a signal matching the container's own stop signal. That stop
signal is resolved by the same rule nerdctl stop already uses
(containerutil.getSignal): the stopSignal label if present, SIGTERM
otherwise, so the two commands cannot disagree about what stops a container.
An unparsable stopSignal label is returned as an error rather than guessed
at, matching what nerdctl stop already does with it.

nerdctl stop is unchanged: it stops the container by definition, so it
still sets the label unconditionally.

Validation:

• make lint-go-all (linux/windows/freebsd/darwin) and make lint-mod: 0 issues,
  using the golangci-lint version pinned in install-dev-tools
• make lint-commits: PASS
• New unit test TestIsStopSignal (6 cases) and integration test
  TestRunRestartAlwaysKillSignal (3 subtests) pass against containerd 2.2.2
  • runc 1.4.0 on Ubuntu 26.04 (aarch64)
• Checked both tests actually fail without the fix: making IsStopSignal
  always return true fails only the non-stop-signal subtest, and narrowing it
  to SIGKILL only fails only the stop-signal-match subtest
• make test: unchanged except pkg/resolvconf.TestGet, which fails the same
  way on a clean checkout of main in this environment

closes: #5171

[somaz94]

The three failing jobs look unrelated to this change.

TestSaveQuiet, TestLoadQuiet and TestSaveContent are image save/load tests,
and TestNetworkInspectWithContainers fails on hcnCreateNetwork "object already
exists". This PR only touches killContainer. I ran all three save/load tests
against this branch on containerd 2.2.2 and they pass.

The test workflow on main has failed 14 of its last 15 runs, with different
tests each time, so I don't think waiting for a green run here is meaningful.
Happy to rebase if you'd rather I retry against a newer main.