feat(vm): move supervisor outside guest boundary

[drew]

Summary

Use the VM backend as the first prototype implementation of RFC 0012 directly above the backend contract and supervisor primitives. This is PR 3 of 4 in the review stack.

The libkrun VM supervisor moves out of the guest boundary and onto the host while retaining the current custom guest kernel; the guest runs only an authenticated, portable process-supervision leaf.

Stack: #2941 → #2942 → this PR → #2965.

The VM implementation uses the contract's single attach entry operation. The Docker attach-time boundary-establishment proof continues in #2965. Existing Kubernetes and Podman topologies remain on their legacy orchestration paths.

Related Issue

Part of #1737. Builds on RFC #2048 and the RFC 0012 contract/primitives stack.

Changes

• Add openshell-isolation-vm as the reusable authenticated host/guest transport and protocol crate.
• Run openshell-sandbox as the host-side logical supervisor and restrict the guest to workload lifecycle operations.
• Add a VM-only topology activation path without importing the in-pod backend or changing other compute drivers.
• Preserve the existing custom kernel, rootfs, overlay, and libkrun boot path.
• Keep gateway credentials, policy, middleware, network enforcement, SSH, and relay registration outside the guest boundary.
• Add guest lifecycle, exec, PTY, port-forward, mediation, and enforcement-confirmation operations.
• Package a driver-controlled guest helper runtime for trusted ip and nft execution.
• Update the sudo-free KVM runner, packaging, workflows, architecture documentation, and gateway configuration reference.

Testing

• mise run pre-commit passes
• cargo check -p openshell-isolation-vm -p openshell-sandbox -p openshell-driver-vm --all-targets
• cargo test -p openshell-isolation-vm (6 passed)
• cargo test -p openshell-driver-vm --lib (136 passed)
• Sandbox VM topology CLI test
• Real KVM e2e smoke via OPENSHELL_E2E_VM_TEST=smoke e2e/rust/e2e-vm.sh (passed in 92 seconds)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture documentation updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2945.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.