refactor(compute): decouple gateway driver composition - #2823

Summary

Move first-party compute-driver composition and VM process ownership into openshell-gateway, leaving openshell-server independent of compute backend implementations. The standard gateway installs drivers through a generic registry, can build without linked compute backends, and preserves the public compute-driver RPC path for external drivers.

Related Issue

Part of #2417.

Changes

• add openshell-gateway as the binary and first-party compute-driver composition crate
• gate linked first-party registrations behind the in-tree-compute-drivers feature
• replace backend-specific server construction with generic driver registrations, factories, metadata, and build context
• move VM subprocess ownership and first-party Docker, Podman, Kubernetes, VM, and Windows MXC composition to the gateway boundary
• preserve driver-free gateway builds and external-driver operation for Docker, Podman, Kubernetes, and VM
• move Docker and Podman socket discovery into their driver crates, including native and machine-backed Podman discovery
• keep compute-driver telemetry categories bounded and move driver-specific tracing setup to registrations
• carry user_namespaces as a typed compute-driver field, translate it to Kubernetes hostUsers, and accept the legacy platform_config.host_users encoding during rolling upgrades
• carry the canonical create-time SandboxPolicy in DriverSandboxSpec.policy, so validation and creation use one complete sandbox message
• use the default-safe driver_reports_runtime_readiness capability solely for readiness composition instead of coupling readiness and policy behavior in a runtime-control enum
• leave later policy revisions on the existing GetSandboxConfig and ReportPolicyStatus extension contract rather than adding a compute-driver reconcile RPC or recreate capability
• compose MXC through the ordinary InProcess variant, with driver-reported readiness and create-time policy enforcement; remove the MXC-only policy side channel and InProcessWithSandboxPolicy
• remove the gateway-side live-policy rejection that was tied to backend identity
• update architecture, public compute-driver documentation, packaging, deployment scripts, E2E wiring, Windows build guidance, and related agent skills
• remove stale backend-specific comments and obsolete openshell-server binary build references

Testing

• mise run pre-commit
• OPENSHELL_SYSTEM_GATEWAY_DIR=/tmp/codex-openshell-empty-system-config mise run test
• focused server test suite and Linux MXC package test target (cargo test -p openshell-server -p openshell-driver-mxc)
• cargo check -p openshell-server -p openshell-gateway --all-features
• mise run helm:test (106 tests)
• cargo check -p openshell-gateway --no-default-features
• cargo check -p openshell-gateway --features in-tree-compute-drivers
• focused gateway registration and Kubernetes user-namespace tests
• mise run e2e:gateway:no-compute-drivers
• Docker, Podman, and Kubernetes external-driver E2E jobs
• Linux and macOS gateway build jobs
• remaining branch E2E and aggregate CI jobs are still running
• native Windows MSVC build/test lane (not available on this host)

Checklist

• Changes are scoped to accepted issue refactor(compute): define driver shutdown and restart lifecycle contract #2417
• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture documentation is updated
• Public compute-driver documentation is updated
• The readiness flag defaults to supervisor-session composition for drivers that omit it