Regression since v2.1.3: removing CRI containers fails on missing network annotations #5207

Description

Removing a stopped Kubernetes/CRI-created container fails with unexpected end of JSON input when its OCI spec lacks the nerdctl/networks annotation. This appears to reintroduce #3765 / #3771: #4290 added an early return after NetworkOptionsFromSpec, before the existing nonfatal fallback and c.Delete.

Confirmed with official release binaries on the same Linux/containerd host:

• v2.1.3: nerdctl -n k8s.io rm <id> exits 1; container record remains.
• v2.1.2: immediately afterward, removes that exact same exited container, exit 0 (network metadata warning is nonfatal).
• v2.3.5: a fresh equivalent exited CRI container fails identically, exit 1; record remains.

Steps to reproduce the issue

On a disposable Kubernetes/containerd test node, using a namespace where this Pod is permitted:

apiVersion: v1
kind: Pod
metadata:
  name: nerdctl-rm-repro
spec:
  restartPolicy: Never
  containers:
    - name: probe
      image: busybox:1.34.1
      command: ["sh", "-c", "echo repro; exit 0"]

1. Create the Pod and wait for phase Succeeded (our test used an already-cached mirror of busybox).
2. On its assigned node, obtain its container ID from crictl ps -a or the Pod's status.containerStatuses[].containerID (strip containerd://). Confirm crictl inspect <id> reports CONTAINER_EXITED.
3. Confirm ctr -n k8s.io containers info <id> shows io.cri-containerd.kind=container and no nerdctl/networks spec annotation.
4. Run standalone v2.1.3 nerdctl -n k8s.io rm <id>, check exit code and whether ctr -n k8s.io containers info <id> still succeeds.
5. Repeat with v2.1.2 on the same record. Use a fresh completed Pod to test v2.3.5.
6. Delete the disposable Pods with kubectl afterward. Do not use active workloads for this test.

Describe the results you received and expected

v2.1.3 and v2.3.5:

level=fatal msg="1 errors:\nunexpected end of JSON input"
exit_code=1
container_record=present

v2.1.2, on the same record previously rejected by v2.1.3:

level=info msg="unable to retrieve networking information for that container" ... error="unexpected end of JSON input"
<container-id>
exit_code=0
container_record=absent

Expected: preserve #3771's nonfatal handling of missing nerdctl network annotations and remove the exited container. If cross-tool removal is intentionally unsupported, please fail clearly before making partial changes.

Related independent report: rancher-sandbox/rancher-desktop#9116.

What version of nerdctl are you using?

Official Linux amd64 release binaries v2.1.2, v2.1.3, and v2.3.5; archives verified against release SHA256SUMS.

Are you using a variant of nerdctl?

No; official upstream binaries.

Host information

Linux; Kubernetes-created container. Detailed host configuration omitted.

Source comparison: v2.1.2 remove.go, v2.1.3 remove.go, v2.3.5 remove.go.