[Luomu (cloudonly)]

VOLUMES checkpoints require a volume mounted by a container that the selected runtime can capture. Templates without one were accepted by the API and failed only when a checkpoint was attempted.

Validate this at template creation: both runtimes accept mounted durable-dir volumes, and micro-VM also accepts mounted external volumes. Declared but unmounted volumes and CSI-only gVisor templates are rejected with InvalidArgument. This applies whether Golden snapshots are enabled or disabled.

Adds validation regressions, fixes the existing VOLUMES functional-test fixture to mount its durable data, and documents the requirement. This is an independent prerequisite for #2543; it does not change Golden placement or public request schemas.

Validation

Validated a78f8e22 on Linux/amd64 with Go 1.27.1:

• go test -race -count=1 ./... passed, including the complete functional suite with PostgreSQL and Kubernetes envtest.
• Targeted request-validation and VOLUMES functional regressions passed with the race detector.
• hack/verify-all.sh passed all 15 verifiers. The initial lint package load exceeded its existing timeout; a rerun after package-cache warmup passed without changing the timeout or checks.
• ateapi, atelet, and kubectl-ate builds passed.
• go test -race -count=1 ./... passed in tools/apitool.
• Local request-validation race tests passed.

The invalid-template regressions were observed failing before the validation change. Functional tests use PostgreSQL and Kubernetes envtest with a fake atelet; real gVisor/micro-VM E2E was not run.

AI assistance: Codex helped implement, review, and validate this change.

[Luomu (cloudonly)]

Closing in favor of #1972, which implements the same admission rule for #1936 and carries the issue link, a fuller validation matrix (including image volumes and unmounted CSI volumes), and the custom-validation doc updates. The user documentation from this PR now lives in #1972, placed beside the ROOTFS rule in the template spec table. #2543 now stacks on #1972.