Please address the comments from this code review:

## Overall Comments
- In `_run_cr_test_with_config`, the result of `run_cr_test` is ignored and the function only checks for log files, so a failing checkpoint/restore that still writes logs would incorrectly be reported as success; consider propagating the `run_cr_test` exit status as part of the return value.
- The tests write and delete config files under `/etc/criu`, which can require elevated privileges and may interfere with host configuration; it would be safer to use a test-local directory and point CRIU to it rather than mutating `/etc`.
- The error from `handle_criu_config_file` is wrapped at the call sites with a generic `"libcriu doesn't support RPC config file"` message, which hides the more specific reason (e.g. CRIU version too old); consider returning or augmenting the original error text instead of overwriting it.

## Individual Comments

### Comment 1
<location> `src/libcrun/criu.c:495` </location>
<code_context>
+      config_file = CRIU_CRUN_CONFIG_FILE;
+    }
+
+  libcriu_wrapper->criu_set_config_file (config_file);
+
+  return 0;
</code_context>

<issue_to_address>
**issue (bug_risk):** The return value of criu_set_config_file is ignored, potentially hiding CRIU-side configuration errors.

`criu_set_config_file` returns an `int`, so it can fail (e.g., invalid path, permissions, CRIU errors). Ignoring this means checkpoint/restore continues as if the config was applied when it may not have been.

Please capture and return the error, e.g.:

```c
int ret = libcriu_wrapper->criu_set_config_file(config_file);
if (UNLIKELY(ret < 0))
  return crun_make_error(err, 0, "failed to set CRIU config file '%s'", config_file);
```

and have callers of `handle_criu_config_file` propagate the error so config failures are visible to the caller.
</issue_to_address>

### Comment 2
<location> `tests/test_checkpoint_restore.py:283-285` </location>
<code_context>
+            raise
+
+
+def _clean_up_criu_configs():
+    for conf_file in ["crun.conf", "runc.conf", "annotation.conf"]:
+        _remove_file(os.path.join("/etc/criu", conf_file))
+
+
</code_context>

<issue_to_address>
**suggestion (testing):** Consider guarding tests that modify `/etc/criu` to avoid permission-related flakiness

These tests create and delete files under `/etc/criu`, which typically requires root. When run by an unprivileged user, they’ll fail with permission errors rather than exercising the intended behavior. Please either restrict them to privileged/CI runs or add a skip condition (e.g., `os.access("/etc/criu", os.W_OK)`) to avoid flaky local failures.

Suggested implementation:

```python
import errno
import pytest

```

For this guard to be effective for all tests that touch `/etc/criu`, ensure that:
1. Each test that creates/deletes `/etc/criu` config files calls `_clean_up_criu_configs()` before performing any write/cleanup under `/etc/criu`.
2. If there are other helpers that write into `/etc/criu` directly (not via `_clean_up_criu_configs()`), consider adding a similar `os.access("/etc/criu", os.W_OK)` check (and `pytest.skip`) in those helpers or at the top of the respective tests.
</issue_to_address>

### Comment 3
<location> `tests/test_checkpoint_restore.py:342-348` </location>
<code_context>
+    return _run_cr_test_with_config("crun", ("crun-dump.log", "crun-restore.log"), extra_configs=extra)
+
+
+def test_cr_with_annotation_config():
+    # Create annotation config file
+    annotations = {"org.criu.config": "/etc/criu/annotation.conf"}
+    _create_criu_config("annotation", f"log-file=annotation.log")
+    # The following config files should be ignored by crun
+    extra = {"runc": "log-file=test-runc.log", "crun": "log-file=test-crun.log"}
+    return _run_cr_test_with_config("annotation", ("annotation.log", "annotation.log"), extra_configs=extra, annotations=annotations)
+
+
</code_context>

<issue_to_address>
**nitpick:** Redundant pre-creation of `annotation.conf` in `test_cr_with_annotation_config` may obscure the behavior being tested

In `test_cr_with_annotation_config`, the call to `_create_criu_config("annotation", "log-file=annotation.log")` is immediately overridden by the `before_checkpoint_cb`/`before_restore_cb` logic in `_run_cr_test_with_config`, which writes a new `annotation.conf` in the temp directory. This makes the initial creation redundant and potentially misleading, since it suggests the test relies on a pre-existing config. Please either remove the initial `_create_criu_config` call or add a brief comment noting that the callbacks always overwrite any existing file.
</issue_to_address>