feat(docker): adopt shared supervisor boundary mode

[drew]

Summary

Adopt the shared openshell-sandbox --mode=control / --mode=boundary convention in the Docker driver. The gateway launches host control while the sandbox container runs boundary mode as PID 1 beside, and as the parent of, the agent workload.

This is PR 5 of 6. Its incremental implementation is contained in the existing Docker driver, with the associated workspace lockfile and one Docker E2E fixture update.

Stack: #2941 → #2942 → #3151 → #2945 → this PR → #3144.

Related Issue

Part of #1737. The issue does not currently carry state:accepted or roadmap placement; this implementation proceeds under direct maintainer instruction without changing those labels.

Changes

• Replace the Docker-specific seccomp-notify prototype with the common RFC 0012 boundary protocol.
• Run host control from the trusted supervisor artifact and boundary mode as container PID 1.
• Set Docker network_mode=none; boundary creates the nested workload network namespace and relays mediated egress to host control.
• Preserve policy hostnames and Docker host aliases without restoring direct container networking.
• Use a private, length-bounded Unix control socket with authenticated bootstrap material and immutable container/image/topology claims.
• Resolve the OCI user and working directory inside the container filesystem and protect bootstrap configuration before starting the workload.
• Harden host runtime state with private ownership/modes, no-follow file handling, parent-death fencing, stale socket/process cleanup, and fail-closed control readiness.
• Reject unsupported VM-backed Docker daemon topologies where the host-side control process cannot share the daemon's network namespace safely.
• Preserve Docker driver ownership of image, container, stop/start, deletion, and reconciliation lifecycle.

Testing

• mise run pre-commit
• cargo test -p openshell-driver-docker
• mise run e2e:docker
• Targeted port-forward, proxy-egress policy reload/deny, credential rewrite, allowed-IP, and L7 forward-proxy scenarios
• Live Docker gateway smoke: create, policy allow/deny, exec, connect, logs, stop/start, and delete

Checklist

• Authored implementation commits follow Conventional Commits and include DCO sign-off
• Docker behavior remains implemented in crates/openshell-driver-docker; non-driver changes are limited to the lockfile and Docker E2E fixture
• Driver documentation and validation paths are updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2965.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for c63a604. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.