refactor(supervisor): add backend-neutral boundary primitives

[drew]

Summary

Add backend-neutral process and network boundary primitives on top of the RFC 0012 contract while preserving the existing supervisor orchestration path. This is PR 2 of 6 in the stack.

Stack: #2941 → this PR → #3151 → #2945 → #2965 → #3144.

These primitives provide the local enforcement building blocks used by the control/boundary runtime split in the next PR.

Related Issue

Part of #1737. The issue does not currently carry state:accepted or roadmap placement; this implementation proceeds under direct maintainer instruction without changing those labels.

Changes

• Add boundary-owned process, exec, PTY, signal, wait, loopback forwarding, and cleanup primitives around the canonical main-process session.
• Track managed children with generation-bearing registrations so PID reuse cannot unregister a newer process; always reap and unregister failed exec waits.
• Add the focused openshell-binary-identity helper crate with stable procfs snapshot validation and fail-closed executable attribution.
• Allow network enforcement to consume an optional backend mediation source while retaining transparent TCP and legacy listener paths.
• Preserve provider state, mediated DNS, policy-visible destination metadata, and backend-provided host-gateway routes.
• Add strict network-namespace egress-ceiling installation and verification APIs.
• Keep Linux-specific enforcement and tests correctly gated on portable builds.

Testing

• cargo test -p openshell-isolation-interface — 22 passed
• cargo test -p openshell-binary-identity — 2 passed
• cargo test -p openshell-supervisor-process --lib — 270 passed, 2 ignored
• mise run pre-commit

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Shared crate inventory and binary-identity documentation are updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for b06e0b1. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.