feat(vm): adopt shared supervisor boundary mode

[drew]

Summary

Adopt the shared openshell-sandbox --mode=control / --mode=boundary convention in the libkrun VM driver. Host control retains policy, gateway, proxy, SSH, and lifecycle authority; the embedded guest boundary owns and observes the workload over an authenticated vsock channel.

This is PR 4 of 6. Its incremental implementation is contained in the existing VM driver, with the associated workspace lockfile and VM build/E2E harness updates.

Stack: #2941 → #2942 → #3151 → this PR → #2965 → #3144.

Related Issue

Part of #1737. The issue does not currently carry state:accepted or roadmap placement; this implementation proceeds under direct maintainer instruction without changing those labels.

Changes

• Replace the VM-specific guest-control protocol with the common RFC 0012 boundary protocol.
• Run the native host supervisor in control mode and the embedded guest runtime in boundary mode.
• Authenticate the vsock topology with VM generation and immutable image identity claims.
• Keep gateway credentials, policy evaluation, network enforcement, middleware, SSH, and relay registration on the host.
• Keep process creation, exec, signaling, PTY, loopback forwarding, and binary identity observation in the guest boundary.
• Route guest egress and host aliases through control while preserving libkrun/QEMU lifecycle, overlays, GPU support, and recovery.
• Harden lifecycle and recovery: use absolute state paths, validate cached guest artifacts, clear inherited environment, fence parent death, and stop control before tearing down the VM.
• Rebuild the native control supervisor in the VM development and E2E launch paths so it cannot drift from the embedded boundary protocol.

Testing

• mise run pre-commit
• cargo test -p openshell-driver-vm
• Full VM E2E, including sandbox startup, host aliases, inference/provider paths, and gateway restart
• Live VM gateway smoke: create, policy allow/deny, exec, connect, logs, stop/start, and delete

Checklist

• Authored implementation commits follow Conventional Commits and include DCO sign-off
• VM behavior remains implemented in crates/openshell-driver-vm; non-driver changes are limited to the lockfile and VM-specific build/E2E support
• Driver documentation and validation paths are updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2945.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for e51b65f. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.