feat(vm): move supervisor outside guest boundary

[drew]

Summary

Use the VM backend as the prototype implementation of RFC 0012 directly above
the backend contract and supervisor primitives stack. The libkrun VM supervisor
moves out of the guest boundary and onto the host while retaining the current
custom guest kernel; the guest runs only an authenticated, portable
process-supervision leaf.

Stack: codex/1737-rfc12-contract (#2941) →
codex/1737-rfc12-supervisor-primitives (#2942) → this PR.

The Docker supervisor-owned creation proof now continues independently in
#2965, stacked on this PR. Existing production Docker, Kubernetes, and Podman
topologies remain on their legacy orchestration paths.

Related Issue

Part of #1737. Builds on RFC #2048 and the RFC 0012 contract/primitives stack.

Changes

• Add openshell-isolation-vm as the reusable authenticated host/guest
  transport and protocol crate.
• Run openshell-sandbox as the host-side logical supervisor and restrict the
  guest to workload lifecycle operations.
• Add a VM-only topology activation path without importing the in-pod backend
  or changing other compute drivers.
• Preserve the existing custom kernel, rootfs, overlay, and libkrun boot path.
• Keep gateway credentials, policy, middleware, network enforcement, SSH, and
  relay registration outside the guest boundary.
• Add guest lifecycle, exec, PTY, port-forward, mediation, and
  enforcement-confirmation operations.
• Package a driver-controlled guest helper runtime for trusted ip and nft
  execution.
• Update the sudo-free KVM runner, packaging, workflows, architecture
  documentation, and gateway configuration reference.

Testing

• mise run pre-commit passes
• cargo check -p openshell-isolation-vm -p openshell-sandbox -p openshell-driver-vm --all-targets
• cargo test -p openshell-isolation-vm (6 passed)
• cargo test -p openshell-driver-vm --lib (136 passed)
• Sandbox VM topology CLI test
• Real KVM e2e smoke via OPENSHELL_E2E_VM_TEST=smoke e2e/rust/e2e-vm.sh
  (passed in 92 seconds)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture documentation updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2945.docs.buildwithfern.com/openshell