refactor(config): introduce canonical gateway configuration

[jhjaggars]

Summary

Introduce canonical gateway configuration names and ownership while preserving every currently accepted input, default, and effective runtime behavior. This is the compatibility/expansion half of the two-PR migration for #2792; alias removal and intentional behavior changes remain deferred to one coordinated follow-up.

Related Issue

Part of #2792

Changes

• Rename Docker sandbox_namespace to sandbox_label, preserving the serde alias, gateway inheritance behavior, and persisted openshell.sandbox_namespace container label.
• Rename Podman sandbox_ssh_socket_path to ssh_socket_path, preserving the serde alias and standalone CLI/environment surface.
• Rename VM subprocess openshell_endpoint/--openshell-endpoint to grpc_endpoint/--grpc-endpoint, preserving serde and hidden clap aliases.
• Add canonical singular compute_driver = "<name>" TOML while accepting legacy compute_drivers = [...] with its existing empty/single/multiple runtime semantics. Existing Rust, CLI, environment, and API representations remain unchanged.
• Move canonical Kubernetes namespace, service_account_name, and enable_user_namespaces ownership into [openshell.drivers.kubernetes]. Gateway-level fields remain accepted as lower-precedence compatibility inputs.
• Omit the non-expiring default gateway_jwt.ttl_secs = 0 from canonical serialization and expose effective optional-duration semantics internally while continuing to accept explicit zero and preserve runtime behavior.
• Reject configurations that specify both canonical and legacy names, and update in-tree producers, Helm rendering, packaged defaults, E2E fixtures, scripts, architecture, RFCs, agent guidance, and published documentation to emit canonical forms.

Compatibility guarantees

• Previously valid configurations continue to parse.
• Existing defaults and effective runtime behavior are unchanged.
• Explicit legacy Docker overrides prevent inherited canonical-key injection.
• Canonical driver-table values take precedence over gateway compatibility inputs.
• Standalone Podman and VM subprocess invocations retain their legacy flags/environment behavior.

Deferred follow-up

The coordinated breaking/additive follow-up will remove compatibility aliases, enforce strict schema semantics, replace remaining sentinel values, reconcile shared image-pull and callback/TLS modeling, resolve VM UID semantics, and add proxy/AppArmor/SPIFFE parity. This PR does not close #2792.

Testing

• mise run pre-commit
• mise run test
• mise run ci (39 tasks)
• Targeted Rust tests (1,381 passed; 7 ignored)
• Helm unittest suite (104 tests)
• Podman E2E podman_gateway_start (1 passed), using canonical compute_driver
• Shell syntax checks for modified E2E/task scripts

E2E environment notes:

• A prior full Podman run loaded canonical configuration and passed 75 tests before the unrelated provider_refresh_handles credential probe failed; an isolated retry reproduced the infrastructure failure.
• Docker cannot start locally because docker is a Podman compatibility shim and no Docker daemon is reachable.
• VM loads canonical configuration and starts the driver, but local provisioning stops because mke2fs/mkfs.ext4 is unavailable.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated
• User-facing and deployment documentation updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.