bug(supervisor): an isolation backend's Attach refusal is not reported to the gateway #4739

User Story

I maintain an out-of-tree OpenShell compute driver whose isolation backend refuses, at Attach, any policy it can't enforce. When it refuses one, the user needs to see the backend's reason on the sandbox. Today they see only that the supervisor exited.

Problem Statement

In run_sandbox_with_backend (crates/openshell-supervisor/src/lib.rs), the call selected_backend.attach(...) ends in .await?. When the backend refuses (BackendError::Denied, Descriptor or Attach), the supervisor returns the error and exits without telling the gateway:

• No configuration rejection: the startup loop already reports rejected configuration through reject_startup_configuration with ConfigurationAdmissionState::Rejected, for example "Effective policy is unavailable after image discovery". An Attach refusal is the backend rejecting the same configuration, but it doesn't take that path.
• No policy status: report_initial_policy_failure reports a policy that fails to build, but not one the backend refuses.
• A write before admission: the startup loop runs enrich_proto_baseline_paths and syncs the widened policy back as a new sandbox revision ("Enriched policy synchronization") before Attach. When Attach then refuses that policy, the revision stays in the store with status Pending and no error until something supersedes it.

The gateway learns of the failure only from the compute driver's own report that the supervisor exited, which can't carry the backend's reason.

Impact / Why This Matters

• No reason for the user: the sandbox goes to Error with the driver's generic reason. The backend's reason is only in the supervisor's stderr, which a driver may keep somewhere the operator or user can't read (for example a root-owned log).
• A misleading policy history: openshell policy list shows a revision the supervisor wrote itself, Pending with an empty ERROR column. Users don't know where it came from or why it never loaded.
• Silent narrowing of RFC 0012's "reject policy it cannot enforce": the rejection happens, but nothing user-visible records it.

Acceptance Criteria

• When Attach fails with a backend error, the supervisor reports the configuration as Rejected with the backend's message before it exits, as reject_startup_configuration does.
• A revision the supervisor wrote during startup, and that the backend then refused, ends Failed with that message instead of Pending.
• openshell sandbox get shows the backend's reason in the ConfigurationReady condition.

Reproduction Steps

Reproduced live at b58e24c9d with an out-of-tree macOS backend whose Attach refuses any policy except one fixed offline profile:

1. openshell sandbox create --name iso3 --policy <fixed offline policy> --detach -- /bin/sleep 3600; it reaches Ready.

2. openshell policy update iso3 --add-endpoint example.com:443; version 2 is reported Effective.

3. openshell sandbox stop iso3, then openshell sandbox start iso3.

4. Observed:

   • the start fails with SupervisorExited: native supervisor exited without a stop request (the driver's reason);
   • openshell policy list iso3 shows a version 3 that the supervisor wrote at startup (version 2 plus the baseline paths such as /tmp), Pending with no error;
   • the gateway log has UpdateConfig: new policy version persisted ... version=3, then the phase change to Error, and nothing from the backend.

   Expected: ConfigurationReady False with the backend's message, runtime policy does not match the admitted native offline profile, and version 3 Failed with the same message.

Suggested UX (if applicable)

$ openshell sandbox get iso3
Phase:  Error
  - ConfigurationReady: False (ConfigurationRejected) - isolation backend 'macos-appsandbox' refused attachment: runtime policy does not match the admitted native offline profile

Environment

• OpenShell: main at b58e24c9d; not yet in a release
• OS: macOS 26.7.1 (25G241), Apple silicon
• OpenShell deployment mode and runtime: gateway with an out-of-tree compute driver and a registered isolation backend that validates the policy at Attach

Logs

INFO openshell_server::grpc::policy: UpdateConfig: new policy version persisted sandbox_id=ad1f057c-... version=3
INFO openshell_server::compute: Sandbox phase changed sandbox_name=iso3 old_phase=Starting new_phase=Error
WARN openshell_server::compute: Sandbox failed to become ready sandbox_name=iso3 reason=SupervisorExited native supervisor exited without a stop request