feat(gateway): support runtime image env overrides

[elezar]

🏗️ build-from-issue-agent

Summary

Add gateway-process overrides for the trusted sandbox-runtime and supervisor OCI images used by the built-in Docker, Podman, and Kubernetes drivers. The environment variables act as alternatives to the existing compiled defaults, so the normal configuration flow preserves driver TOML > process environment > compiled default.

Related Issue

Closes #3502

Changes

• Make OPENSHELL_SANDBOX_RUNTIME_IMAGE and OPENSHELL_SUPERVISOR_IMAGE the process-level defaults used consistently by Docker, Podman, and Kubernetes.
• Keep explicit selected-driver TOML authoritative through the existing serde defaults, without a second gateway resolution layer.
• Keep trusted image fields outside sandbox request schemas.
• Convert Debian package qualification to inject exact candidate images through the packaged gateway.env mechanism without generating operator TOML.
• Document precedence, supported reference forms/drivers, package delivery, diagnostics, and trust implications.

Deviations from Plan

• Image environment values intentionally use the same validation path as equivalent driver TOML values instead of introducing a separate OCI parser at the gateway composition layer.
• The local tmachine acceptance run could not reach the changed service path because this checkout did not contain its required prebuilt artifacts/packages/openshell.deb and staged image/test artifacts. The Release Dev/Tag integration matrix builds and supplies those inputs for the existing ubuntu-docker-rootful + deb + conformance lane.

Testing

• mise run pre-commit passes (run with Nix-provided mise because the host PATH has no mise binary)
• Unit tests added/updated
• Installed-package tmachine E2E completed locally (attempted; prerequisite artifacts absent before package copy)

Tests run:

• cargo test -p openshell-core runtime_image_environment_value_replaces_compiled_default — 1 passed
• cargo test -p openshell-driver-docker sandbox_driver_config_rejects_trusted_runtime_image_overrides — 1 passed
• cargo test -p openshell-driver-podman -p openshell-driver-kubernetes sandbox_driver_config_rejects_trusted_runtime_image_overrides — 2 passed
• cargo check -p openshell-core -p openshell-gateway -p openshell-driver-docker -p openshell-driver-podman -p openshell-driver-kubernetes --all-targets — passed
• bash tasks/scripts/test-packaging-assets.sh — passed (Debian artifact staging skipped because dpkg-deb is unavailable on macOS)
• nix run .#tmachine -- test ubuntu-docker-rootful deb conformance — environment setup passed; installer stopped before exercising the change because artifacts/packages/openshell.deb was absent

Checklist

• Follows Conventional Commits
• Commit is signed off (DCO)
• Documentation updated
• Related public debugging skill reviewed and updated

Documentation updated:

• Gateway configuration and compute-driver references
• Linux installation and RPM configuration guides
• Gateway man page and build architecture notes
• Public cluster-debugging skill

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3504.docs.buildwithfern.com/openshell