Fix ContainerCallback cancellation race and goroutine lifecycle

[khuswant18]

Summary

MalwareManager.ContainerCallback can race between the delayed scannedFiles initialization started when a container is added and the cleanup performed when that container is removed.

The delayed background task must be cancelled and synchronized with container removal so that it cannot recreate state after the container has already been deleted.

Problem

When a container is added, ContainerCallback starts delayed background work that initializes the container's scannedFiles state after InitialDelay.

When the container is removed before that delay completes, the removal path cancels the background work and deletes the container state.

The timer callback and removal path can still race around this transition. A possible sequence is:

1. The delayed timer becomes ready.
2. The timer callback checks the cancellation state.
3. The container is removed and its state is deleted.
4. The timer callback continues and recreates scannedFiles for the removed container.

This can leave stale state after the container lifecycle has already ended.

Impact

• scannedFiles can be recreated after a container has been removed.
• Container lifecycle state can become stale.
• Delayed background work can outlive the container it belongs to.
• The race is difficult to reproduce reliably with a sleep-based test.

Suggested direction

Synchronize the delayed timer transition and container removal cleanup as a single per-container state transition.

The cancellation and cleanup path should ensure that the timer callback cannot mutate scannedFiles after removal has completed.

Add a deterministic regression test covering the boundary between the delayed timer becoming ready and container removal. The test should avoid relying solely on time.Sleep and should be suitable for the Go race detector.

Scope

Keep the change limited to the MalwareManager.ContainerCallback lifecycle and the corresponding regression test.

No unrelated refactoring or behavior changes are required.

Validation

The fix should be validated with:

• the affected malwaremanager unit tests
• the Go race detector
• the relevant node-agent test suite