feat(python): expose raw gateway client

[dhirajsb]

Summary

Expose a supported raw gateway floor in the Python SDK so every generated OpenShell RPC is reachable over the existing authenticated channel. This mirrors the TypeScript SDK pattern while keeping curated Python methods as the preferred interface.

Related Issue

Fixes #2960

Changes

• Add SandboxClient.raw for the generated OpenShellStub and SandboxClient.channel for additional generated service clients.
• Add public openshell.raw exports for generated wire modules and service stubs.
• Document an uncurated Provider credential update, explicit raw-call timeouts, client/channel lifecycle, and server-side authorization.
• Add a descriptor-based drift test proving every OpenShell service RPC remains present on the public raw client.

Testing

• mise run pre-commit passes (mise bootstrap was blocked by an unauthenticated GitHub artifact-attestation rate limit)
• Unit tests added/updated
• uv run --frozen ruff check python
• uv run --frozen ty check python
• uv run --frozen pytest -q python (128 passed)
• Python wheel built and verified with tasks/scripts/verify-python-wheel.py
• E2E tests added/updated (not applicable: generated-client exposure only; no gateway behavior changes)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; public SDK usage is documented in README)

This is opened as a draft while the linked feature request is triaged. I am offering to carry the implementation through review.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}