feat(kubernetes): add proxy-pod supervisor topology

[TaylorMutch]

Summary

Adds the Kubernetes proxy-pod topology on top of the sidecar topology merged in #2076.

proxy-pod moves network enforcement and gateway forwarding into a per-sandbox supervisor Deployment paired 1:1 with the workload pod. The sandbox image runs directly in the workload container; the OpenShell supervisor is not mounted or executed there. This is intentionally a network-only topology and requires Kubernetes NetworkPolicy enforcement.

The product tradeoff is explicit: filesystem/process policy, binary detection, SSH/connect, exec, upload/download, sync, and dynamic provider environment injection are unavailable in this topology. Use combined or sidecar when those capabilities are required.

Related Issue

References #1827, #981, #899, #1305.

Related PRs: #1973, #2074, #2076, #2016.

Changes

• Add the proxy-pod supervisor topology.
• Run network supervision and gateway forwarding in a paired Deployment instead of the sandbox pod.
• Run the sandbox image directly as a non-root workload with all capabilities dropped.
• Inject only standard proxy and CA trust environment into the workload; do not mount gateway credentials or the supervisor binary.
• Create the per-sandbox headless Service, proxy CA Secret, RBAC, owner references, and NetworkPolicies needed for the paired proxy.
• Require NetworkPolicy enforcement to preserve the expected OpenShell network path.
• Add nested proxy_pod.proxy_uid / supervisor.proxyPod.proxyUid configuration.
• Add proxy_pod.affinity / supervisor.proxyPod.affinity with disabled (default), preferred, and required same-node placement modes.
• Add proxy-pod Helm values and Skaffold profile support.
• Document topology choice, architecture, permission model, NetworkPolicy requirements, RuntimeClass status, reduced feature set, and affinity tradeoffs.

Testing

• git diff --check
• cargo test -p openshell-driver-kubernetes --lib (131 passed)
• mise run helm:test (70 passed)
• mise run helm:docs:check
• mise run pre-commit
• Earlier process-supervisor revision: Docker-backed local k3d/k3s L7 allow/deny and live-policy E2E coverage
• Prior validation from feat(kubernetes): add sidecar and proxy-pod topology configurations #2016: proxy-pod topology smoke-tested on Kata Containers and gVisor clusters with NetworkPolicy enforcement enabled

The earlier SSH/exec-driven proxy-pod E2E results predate the direct-workload change. They are retained as evidence for the paired network proxy, but do not validate the intentionally removed process-supervisor session path.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2077.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 9b0766c. Open Branch E2E Checks, find the run for commit 9b0766c, and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.