feat(sandbox): add control and boundary supervisor modes

[drew]

Summary

Add the shared RFC 0012 runtime split between openshell-sandbox --mode=control outside an isolation boundary and openshell-sandbox --mode=boundary beside the workload. This is PR 3 of 6 and provides one portable control protocol and implementation for Docker, VM, Kubernetes, and future drivers.

Stack: #2941 → #2942 → this PR → #2945 → #2965 → #3144.

Related Issue

Part of #1737. The issue does not currently carry state:accepted or roadmap placement; this implementation proceeds under direct maintainer instruction without changing those labels.

Changes

• Add a versioned, authenticated boundary protocol and reusable RemoteIsolationBackend to openshell-isolation-interface.
• Support Unix, authenticated TLS/TCP, and vsock transports for process lifecycle, exec, signal/terminate, wait, PTY I/O, loopback forwarding, binary identity, mediated egress, and DNS.
• Add --mode=control for policy, proxy, gateway, and SSH ownership outside the workload boundary, and --mode=boundary for trusted workload-local execution and observation.
• Preserve and replay running lifecycle state across control reconnects without restarting the canonical workload; retain terminal state after canonical exit.
• Bound output drains, cancel abandoned network accepts, limit unauthenticated connections, enable TCP keepalive, and make shutdown reporting cancellable.
• Reconcile opaque provider credential revisions, preserve policy-visible endpoint metadata, and provision durable interception CA material through Landlock-safe paths.
• Publish readiness only after relay registration and support IPv4 or IPv6 control health listeners.
• Update RFC 0012, sandbox architecture, and supervisor image packaging for the control/boundary trust model.

Testing

• cargo test -p openshell-isolation-interface — 34 passed
• cargo test -p openshell-sandbox --quiet — 134 library, 14 binary, and 1 integration test passed
• cargo test -p openshell-supervisor-process --lib --quiet — 277 passed, 4 ignored
• Retained-boundary provider-reconciliation regression — 20 consecutive isolated passes
• mise run pre-commit

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• RFC and architecture documentation are updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.