runtime: lifecycle: environment must match config.json

Make it clear that if a runtime cannot set up an environment that
*precisely* matches the config.json provided, it must generate an error.
This is important because not doing this can cause security issues.

Signed-off-by: Aleksa Sarai <[email protected]>

Author: cyphar

runtime.md

@@ -34,6 +34,7 @@ See [Query State](#query-state) for information on retrieving the state of a con
 The lifecycle describes the timeline of events that happen from when a container is created to when it ceases to exist.
 1. OCI compliant runtime's `create` command is invoked with a reference to the location of the bundle and a unique identifier.
 2. The container's runtime environment MUST be created according to the configuration in [`config.json`](config.md).
+   If the runtime is unable to create the environment specified in the [`config.json`](config.md), it MUST generate an error.
    While the resources requested in the [`config.json`](config.md) MUST be created, the user-specified code (from [`process`](config.md#process-configuration) MUST NOT be run at this time.
    Any updates to `config.json` after this step MUST NOT affect the container.
 3. Once the container is created additional actions MAY be performed based on the features the runtime chooses to support.