feat(podman): honor OCI image working directories

[matthewgrossman]

Summary

Extend the Docker/shared OCI working-directory support introduced in #2530 to the Podman driver. Podman validates the original immutable image before its workspace volume masks the OCI workdir, then launches the sandbox at the validated path without expanding the image user's filesystem authority.

This work was originally developed on top of #2530. That PR has merged, and this PR now targets main.

Related Issue

Part of #2526

Changes

• resolve the immutable image ID, OCI identity, workdir, and image volumes once for both probe and final launch
• validate non-default OCI workdirs in a resource-limited, networkless probe without the workspace volume, secrets, or sandbox token
• use attempt-unique probe names and exact-name cleanup without sweeping forgeable labels
• derive the probe identity source from the effective global-or-sandbox policy and attest the normalized identity before the final supervisor prepares the managed workspace
• mount Podman persistence at the resolved OCI workdir and reject driver-config or image-declared volumes that would mask it
• bound and sanitize probe diagnostics
• cover Podman OCI identity, supplementary groups, resource limits, cancellation, ambiguous creation, nested volumes, and forged validation metadata
• document the shared no-authority-expansion invariant without duplicating implementation detail

Design note

Issue #2526 originally asked to avoid a new identity protocol. Podman's managed workspace volume hides the original image workdir before the final supervisor starts, so the Docker design cannot validate the original tree in place. This PR therefore adds a narrow internal, Podman-only contract: the gateway sends an explicit oneof describing the effective identity source, and the probe emits a normalized identity attestation that the final supervisor must match. Docker does not receive the identity-source message, and a missing source fails before a non-default Podman workdir can launch.

Testing

• mise run pre-commit
• mise run test
• strict Clippy for affected crates with -D warnings
• focused Podman, supervisor-process, sandbox, and server tests
• E2E coverage added for Podman OCI workdir and identity behavior

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture and user documentation updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2563.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for d7d5cf7. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[matthewgrossman]

gator-agent

PR Review Status

Validation: This PR is project-valid because it implements maintainer-authored, agent-ready issue #2526 and is scoped to the Podman half of the OCI WorkingDir work after #2530 merged.
Head SHA: 2069f04785a9ae0742057684c25f479176e0902e
Base SHA: 490f66f47af4c225fabeb2dc48ea51c67154827c
Merge base SHA: 490f66f47af4c225fabeb2dc48ea51c67154827c
Patch ID: af1aa85fb495511ae397c200658e15602169ca7b
Gator payload: 2
Review mode: initial
Previous reviewed SHA: none

Blocking findings:

• GATOR-2069f047-01: Podman workspace-probe startup recovery can remove containers selected only by the forgeable openshell.workspace-probe=true label.

Carried findings:

• None

Non-blocking suggestions:

• None

Docs: Fern docs and architecture guidance were updated for the user-visible compute-driver behavior.

Next state: gator:in-review

[matthewgrossman]

gator-agent

PR Review Status

Validation: This PR is project-valid because it implements maintainer-authored issue #2526 and extends the merged OCI WorkingDir support to the Podman driver with scoped docs and E2E coverage.
Head SHA: fdf4a19e6fd1b82bfe5a6b8b286e6e8cca433edb
Base SHA: f383ee1038f91921e104405cd01e4150d533fdbe
Merge base SHA: f383ee1038f91921e104405cd01e4150d533fdbe
Patch ID: 897b5986b6d07fd18fe79401e8a6ca725423b9d7
Gator payload: 2
Review mode: follow_up
Previous reviewed SHA: 2069f04785a9ae0742057684c25f479176e0902e

Blocking findings:

• No blocking findings remain. GATOR-2069f047-01 is resolved by the latest probe lifecycle changes: probe names are attempt-unique, ambiguous create conflicts no longer trigger cleanup, and cleanup targets the exact probe name created by this attempt rather than sweeping by a forgeable label.

Carried findings:

• None

Docs: Fern docs and architecture guidance were updated for the user-visible Podman OCI WorkingDir behavior.

E2E: test:e2e is already applied; the required E2E gate is still running.

Next state: gator:watch-pipeline