feat(isolation): enable the co-located RFC 0012 backend

[drew]

Summary

Implement and activate RFC 0012's co-located in-pod backend across combined Docker, Kubernetes, Podman, and VM topologies. This is an unstacked follow-on prototype based on PR #2942.

Dependency: #2942. This PR is intentionally not a member of GitHub stack #2955.

Review-only prototype: The original code author is @jganoff, and the original implementation source is jganoff/OpenShell:jganoff/rfc-0012-impl. This reconstructed work is for reviewing and prototyping RFC 0012; we do not intend to merge this PR. Its dependency chain is rebased onto current main and integrated with the current canonical process and networking architecture.

Related Issue

Follow-on prototype for #1737; not intended to merge.

Changes

• Add the co-located in-pod backend and descriptor-driven sandbox lifecycle.
• Wrap the retained canonical main-process session in the backend-owned process lifecycle.
• Integrate backend-provided mediation streams with current credential, middleware, proxy-health, and transparent-networking behavior.
• Have combined-topology drivers inject the trusted topology descriptor; sidecar topology retains its existing lifecycle.
• Package and mount a driver-controlled ip/nft helper runtime.
• Add boundary-wide cleanup and continuous default-deny egress-ceiling verification.
• Update Docker, Kubernetes, Podman, VM, architecture, operator docs, and related agent skills.

Testing

• Sandbox, supervisor, Docker, Kubernetes, Podman, and VM crates compile
• 21 isolation-contract tests pass
• 122 sandbox library tests pass
• 12 socket-binding tests were blocked by this environment (EPERM), including existing metadata/sidecar tests and two mediation-source tests
• Privileged Linux isolation-conformance CI coverage added

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2943.docs.buildwithfern.com/openshell