feat(kubernetes): host sandboxes on the shared supervisor

.agents/skills/helm-dev-environment/SKILL.md

@@ -68,15 +68,33 @@ gatewayConfig:
     supervisor_topology: gateway
 ```
 
-The gateway chart creates a separate, single-replica shared-host placeholder Deployment
-in the release namespace, regardless of shared/managed/operator workspace mode.
-Use a supervisor image built from this branch: `--mode=shared` is new.
-The chart sets `--gateway-endpoint` from the gateway's gRPC endpoint and
-`--address` to `0.0.0.0:5501`. Check its rollout and TCP health probes on this
-listener (container port `supervisor`, 5501). The outbound gateway connection and
-session RPCs are not implemented yet; sandboxes
-still use dedicated supervisors. `workspace` is reserved and rejected. Omit the
-field to disable it.
+The gateway chart creates a single-replica shared supervisor Deployment,
+Service, NetworkPolicy, and an empty `<release>-supervisor-token` Secret in
+the release namespace, regardless of shared/managed/operator workspace mode.
+The gateway mints a supervisor token from its sandbox-JWT signing key, writes
+it into that Secret (the gateway Role may `get`/`patch` only that Secret), and
+renews it at half its lifetime; the supervisor mounts the Secret and presents
+the token on the private `openshell.supervisor.host.v1` assignment stream,
+which accepts nothing else. The topology requires gateway TLS and the signing
+key (`server.disableTls` is rejected; the gateway refuses to start without
+`gateway_jwt`). New sandbox generations run as sandbox instances in that
+process. The chart starts `--mode=shared`, sets `--gateway-endpoint` to the
+gateway gRPC URL, mounts the token at `--token-file`, and binds `--address`
+(5501) to a plain TCP health listener for the `tcpSocket` probes; nothing
+dials the supervisor but sandbox runtimes (5500) and the kubelet. Build the gateway, supervisor, and sandbox
+images from the same branch: all three must support the routed runtime
+connection and the assignment stream. `workspace` is reserved and rejected.
+Omit the field to disable it. `mise run
+e2e:kubernetes:shared-supervisor` runs the focused e2e
+(`ci/values-supervisor.yaml`). The task prepends that overlay to any
+colon-separated `OPENSHELL_E2E_KUBE_EXTRA_VALUES` list, so layer a
+workspace-mode overlay to cover managed namespaces:
+
+```bash
+OPENSHELL_E2E_KUBE_EXTRA_VALUES=deploy/helm/openshell/ci/values-workspace-managed.yaml \
+OPENSHELL_E2E_KUBE_IMAGE_PULL_SECRET=e2e-regcred \
+  mise run e2e:kubernetes:shared-supervisor
+```
 
 ### 2. Deploy OpenShell
 

AGENTS.md

@@ -26,6 +26,7 @@ Do not rely on this file for a full inventory. The detailed public and contribut
 | `crates/openshell-server/` | Gateway server | Control-plane API, sandbox lifecycle, auth boundary |
 | `crates/openshell-sandbox/` | Sandbox runtime | Capability-free workload launcher, process identity, and seccomp-mediated I/O |
 | `crates/openshell-supervisor/` | Supervisor runtime | Gateway session, policy evaluation, credentials, and upstream networking |
+| `crates/openshell-supervisor-control/` | Shared supervisor control | Gateway-owned assignment controller, launch registrations, recovery coordination, and host observations for a supervisor shared by many sandboxes |
 | `crates/openshell-binary-identity/` | Binary identity | Shared trusted procfs executable identity resolution for isolation backends |
 | `crates/openshell-isolation-interface/` | Isolation backend interface | Shared data and validation for the Isolation Backend RPC contracts |
 | `crates/openshell-sandbox-backend/` | OpenShell sandbox backend | Concrete Isolation Backend RPC client and authenticated Sandbox Protocol shared with `openshell-sandbox` |

crates/openshell-core/src/grpc_client.rs

@@ -564,6 +564,15 @@ pub async fn connect_channel_pub(gateway: &GatewayEndpoint) -> Result<AuthedChan
     connect_channel(gateway).await
 }
 
+/// Build a credential-free gateway channel for callers that attach their own bearer.
+///
+/// Uses the supervisor-side transport settings: server-authenticated TLS from
+/// `OPENSHELL_TLS_CA` and `OPENSHELL_GATEWAY_TLS_SERVER_NAME` for `https`
+/// endpoints, plaintext for `http` ones.
+pub async fn connect_gateway_channel(endpoint: &str) -> Result<Channel> {
+    build_plain_channel(endpoint).await
+}
+
 /// Report installed provider state for the current authenticated supervisor session.
 ///
 /// The observation must carry the session ID returned by `ConnectSupervisor`.