we currently do not differentiate between critical errors (hard failures) and ignorable errors, so that the caller (containers/image in our case) can fallback to using the traditional pull code path.

Especially with composefs and fs-verity, if any error happens in this phase, the entire pull operation must fail and containers/image must not attempt any fallback.

Suggestion: define a new error typefor the errors that can be ignored and treat anything else as an hard failure, so that the caller can differentiate between them.