[Critical] Potential data loss in OCI spec Flush() - file truncated before write #2203

func (s fileSpec) Flush() error {
    if s.Spec == nil {
        return fmt.Errorf("no OCI specification loaded")
    }

    specFile, err := os.Create(s.path)  // ← TRUNCATES FILE HERE
    ...
    return flushTo(s.Spec, specFile)    // ← IF THIS FAILS, DATA IS LOST
}




### Expected Behavior

Write to a temporary file first, then perform an atomic rename/replace only after the write succeeds. This prevents data loss if the write operation fails.

### Impact

- Container runtime configuration (OCI spec) can be permanently destroyed
- Containers using the affected OCI spec will fail to start
- No recovery mechanism if the write fails mid-operation

### Proposed Fix

1. Write modified spec to a temporary file in the same directory
2. If write succeeds, atomically rename temp file to target path
3. If write fails, original file remains intact

### Additional Context

This code path is executed when `nvidia-container-runtime-hook` or `nvidia-container-runtime` applies OCI spec modifications before starting a GPU container.