Add LCOW live migration source and destination pathways

Introduce an end-to-end live-migration workflow for LCOW sandboxes, letting
a running sandbox be handed off from a source shim to a destination shim.

- Add a migration Controller that sequences a single session through a
  source or destination lifecycle: the source prepares and exports an
  opaque sandbox snapshot (VM + per-pod state), while the destination
  imports it, patches each container onto its new IDs, builds the
  destination VM, transfers memory over a shared socket, and finalizes
  with a resume or stop.

- Expose the migration gRPC/ttrpc surface on the LCOW shim service
  (PrepareAndExportSandbox, ImportSandbox, PrepareSandbox, TransferSandbox,
  FinalizeSandbox, Cancel, Cleanup, CreateDuplicateSocket, Notifications)
  and register it alongside the task and sandbox services.

- Wire migration into the task lifecycle: route destination-side CreateTask
  for rehydrated containers into a patch path, and reject task mutations
  (state, delete, kill) while a session is in progress.

- Add duplicated transport-socket adoption, a subscriber-based progress
  notification stream, and proto/HCS conversion helpers for migration
  options and events.

Signed-off-by: Harsh Rawat <harshrawat@microsoft.com>

Author: rawahars

cmd/containerd-shim-lcow-v2/service/mocks/mock_service.go

@@ -7,11 +7,13 @@ import (
 	"fmt"
 	"sync"
 
+	"github.com/Microsoft/hcsshim/internal/controller/migration"
 	"github.com/Microsoft/hcsshim/internal/controller/pod"
 	"github.com/Microsoft/hcsshim/internal/controller/vm"
 	"github.com/Microsoft/hcsshim/internal/log"
 	"github.com/Microsoft/hcsshim/internal/shim"
 	"github.com/Microsoft/hcsshim/internal/shimdiag"
+	migrationsvc "github.com/Microsoft/hcsshim/pkg/migration"
 
 	sandboxsvc "github.com/containerd/containerd/api/runtime/sandbox/v1"
 	tasksvc "github.com/containerd/containerd/api/runtime/task/v3"
@@ -54,6 +56,10 @@ type Service struct {
 	// from podControllers.
 	containerPodMapping map[string]string
 
+	// migrationController orchestrates the live-migration session for the
+	// sandbox. There is at most one active session per shim.
+	migrationController *migration.Controller
+
 	// shutdown manages graceful shutdown operations and allows registration of cleanup callbacks.
 	shutdown shutdown.Service
 }
@@ -68,6 +74,7 @@ func NewService(ctx context.Context, eventsPublisher shim.Publisher, sd shutdown
 		vmController:        vm.New(),
 		podControllers:      make(map[string]*pod.Controller),
 		containerPodMapping: make(map[string]string),
+		migrationController: migration.New(),
 		shutdown:            sd,
 	}
 
@@ -95,6 +102,7 @@ func (s *Service) RegisterTTRPC(server *ttrpc.Server) error {
 	tasksvc.RegisterTTRPCTaskService(server, s)
 	sandboxsvc.RegisterTTRPCSandboxService(server, s)
 	shimdiag.RegisterShimDiagService(server, s)
+	migrationsvc.RegisterMigrationService(server, s)
 	return nil
 }
 
@@ -106,6 +114,14 @@ func (s *Service) ensureVMRunning() error {
 	return nil
 }
 
+// ensureMigrationIdle returns an error if a migration session is in progress.
+func (s *Service) ensureMigrationIdle() error {
+	if state := s.migrationController.State(); state != migration.StateIdle {
+		return fmt.Errorf("migration session is in progress (state: %s): %w", state, errdefs.ErrFailedPrecondition)
+	}
+	return nil
+}
+
 // SandboxID returns the unique identifier for the sandbox managed by this Service.
 func (s *Service) SandboxID() string {
 	return s.sandboxID