fix(supervisor): preserve standard sbin paths in sandbox shells

[elezar]

Summary

Preserve standard sbin directories in supervisor-launched sandbox child shells when CDI exposes tools such as /usr/sbin/nvidia-smi on Orin systems.

Related Issue

No issue required: small localized regression fix discovered while validating stacked PR #2265 on an Orin Docker GPU gateway.

Changes

• Added supervisor child PATH normalization helpers for /usr/local/sbin, /usr/sbin, and /sbin.
• Gated the standard-sbin PATH repair on both the expected CDI context and an effective policy path under a standard sbin directory, such as /usr/sbin/nvidia-smi.
• Installed the idempotent profile.d/.bashrc repair only when the CDI/policy gate is active.
• Hardened startup-file repair so it skips symlinks, parent-directory symlinks, and non-regular startup files instead of following image-controlled paths as root.
• Wrapped supervisor-launched shell -c entrypoints and SSH exec/login-shell commands only when the CDI/policy gate is active.
• Normalized provider-supplied PATH values on both entrypoint and SSH execution paths only when the CDI/policy gate is active.
• Added focused unit tests for gate behavior, PATH normalization, startup snippet idempotency, startup symlink handling, entrypoint shell wrapping, provider PATH handling, and SSH child env handling.

Testing

• mise x -- cargo test -p openshell-supervisor-process standard_sbin
• mise x -- cargo test -p openshell-supervisor-process startup_snippet
• mise x -- cargo test -p openshell-supervisor-process symlink
• mise x -- cargo test -p openshell-supervisor-process inject_provider_env
• mise x -- cargo test -p openshell-supervisor-process apply_child_env
• mise x -- cargo clippy -p openshell-supervisor-process --all-targets -- -D warnings
• Static arm64 supervisor rebuild via PREBUILT_ARCH=arm64 bash tasks/scripts/stage-prebuilt-binaries.sh supervisor-output
• GPU sandbox probe on Orin against local dev gateway: PATH includes /usr/sbin, command -v nvidia-smi resolves /usr/sbin/nvidia-smi, and nvidia-smi -L reports the Orin GPU
• Non-GPU sandbox probe against the same gateway: PATH=/sandbox/.venv/bin:/usr/local/bin:/usr/bin:/bin, confirming the CDI gate leaves ordinary sandboxes untouched
• Docker GPU e2e on Orin against local dev gateway before the CDI gate: 10 passed / 0 failed
• mise run pre-commit passes
  • Attempted again on 2026-08-21; blocked by existing local setup issues: Helm lint reports chart metadata missing postgresql, and workspace Rust lint hits a stale sqlx_macros artifact requiring GLIBC_2.39.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)