feat(compute): delegate sandbox authentication to drivers

[drew]

Summary

Delegate sandbox bootstrap credential authentication to the selected compute driver so in-process and external drivers share the same trust contract. Keep gateway authorization and JWT minting authoritative while moving Kubernetes-specific TokenReview policy behind the Kubernetes driver.

Related Issue

Related to #2417

This is the foundational PR for #2823; #2823 will be rebased on this branch.

Changes

• add the capability-gated AuthenticateSandbox compute-driver RPC
• add a path-scoped gateway authenticator that accepts only the driver-returned sandbox ID
• move Kubernetes TokenReview, namespace, pod UID, and Sandbox owner validation into the Kubernetes driver
• retain Kubernetes bootstrap settings under [openshell.drivers.kubernetes]
• document the driver socket as a sandbox-identity trust boundary and update cluster debugging guidance

Testing

• mise run pre-commit passes (format and Markdown passed; aggregate run was blocked by sandboxed sccache IPC, dependency downloads, and bundled buf execution)
• Unit tests added/updated
• E2E tests added/updated (not run; requires a Kubernetes cluster)

Additional verification:

• cargo check -p openshell-server -p openshell-driver-kubernetes
• cargo check -p openshell-server --tests
• cargo test -p openshell-driver-kubernetes token_review --lib
• cargo clippy -p openshell-server -p openshell-driver-kubernetes --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2968.docs.buildwithfern.com/openshell

[sjenning]

review-github-pr with Sol. Mostly loss of test coverage and some docs updates that were missed.

Potential Concerns

• Security-critical test coverage regresses substantially. The removed authenticator tested audience rejection, every namespace mode, owner-reference validation, path scoping, and error propagation. The replacement adds only two TokenReview helper tests and one annotation test (driver.rs:4963); the new gateway authenticator has no direct tests.
• Agent/docs drift remains: debug-openshell-cluster still tells operators to inspect openshell.io/sandbox-id (SKILL.md:395), while the code now uses openshell.ai/sandbox-id. Gateway-auth and compute-driver docs also still attribute TokenReview validation to the gateway (docs/reference/gateway-auth.mdx:194, docs/reference/sandbox-compute-drivers.mdx:376).
• gateway-config.mdx:253 says external drivers read backend settings from [openshell.drivers.], but remote gateway configuration reads only socket_path (driver_config.rs:52); the external Kubernetes binary receives those settings through CLI flags/environment variables.

[github-actions]

Label test:e2e applied, but pull-request/2968 does not exist yet. A maintainer needs to comment /ok to test 99956e39237f1f350d0d69fd5603840b315a2008 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[sjenning]

/ok to test 99956e3

[drew]

Resolved in 94eaa7c. I restored direct gateway compute-driver authenticator coverage for success, path scoping, missing credentials, empty identities, and driver error propagation; restored Kubernetes TokenReview audience, pod binding, all namespace modes, pod UID/annotation, and controlling Sandbox owner UID/ID validation coverage; updated the debug skill and auth/compute-driver docs to assign TokenReview to the Kubernetes driver and use openshell.ai/sandbox-id; and clarified that an external driver gateway table supplies socket_path while the external process receives its own backend settings through CLI/environment. The focused build also found and fixed the Docker tracing wrapper missing AuthenticateSandbox delegation. The stack PR #2823 has been rebased onto this new base tip.

[drew]

/ok to test 94eaa7c

[drew]

/ok to test bf3b484