feat: bootstrap experimental gateway supervisor deployment #4694

User Story

I am prototyping OpenShell multi-tenant supervision on Kubernetes and need an opt-in deployment path to iterate toward a gateway-scoped supervisor.

Problem Statement

OpenShell currently deploys dedicated supervisors for sandboxes. There is no configuration-controlled way to deploy an experimental, unassigned supervisor independently in the gateway namespace.

Impact / Why This Matters

An isolated deployment bootstrap lets us validate packaging and lifecycle before implementing multi-tenant session admission and routing.

Proposed Design

Use the existing Kubernetes driver gateway configuration as the single source of truth. Setting experimental_supervisor_topology = "gateway" makes Helm deploy one experimental supervisor in the gateway namespace. The supervisor starts without sandbox credentials and exposes process health only; existing sandbox routing is unchanged. Unset retains current behavior. Reserve workspace with an explicit unsupported error for this first increment.

Suggested UX

gatewayConfig:
  openshell.drivers.kubernetes:
    experimental_supervisor_topology: gateway

Acceptance Criteria

• Default installs have unchanged supervision behavior and no extra Deployment.
• Gateway topology creates a separate Helm-owned supervisor Deployment with health checks and graceful shutdown.
• Invalid values and the reserved workspace mode fail clearly.
• Existing sandbox supervisors and authentication remain unchanged.
• Configuration and deployment guidance describe the experimental scope.

Alternatives Considered

A separate top-level Helm flag duplicates gateway configuration. A gateway sidecar couples the experimental process lifecycle to gateway replicas. Existing middleware and interceptors cannot control deployment topology.