refactor(auth): separate sandbox identity from TLS

[drew]

Summary

Separate sandbox identity from transport security. Sandboxes now authenticate the gateway with its CA certificate and authenticate their own RPCs with the bearer-token bootstrap contract landed in #2968, so no user client certificate or private key is exposed inside a sandbox.

Gateway mTLS user authentication remains configurable through [openshell.gateway.mtls_auth] and no longer depends on the selected compute driver. This keeps the driver-free gateway free of first-party driver policy and addresses the authentication concern raised during review of #2823.

Related Issue

Related to #2417.

Follow-up to #2968; addresses review feedback from #2823.

Changes

• require only guest_tls_ca for sandbox-to-gateway TLS across Docker, Podman, Kubernetes, and VM drivers
• stop mounting, projecting, staging, or exporting gateway client certificates and private keys into sandboxes
• use sandbox JWTs as the sandbox identity at the gRPC authorization boundary
• make optional client-certificate verification and mTLS user authentication gateway-owned behavior independent of compute-driver selection
• retain explicit validation errors for obsolete driver cert/key settings instead of silently continuing to expose those credentials
• update architecture, gateway configuration, authentication, security, deployment, driver, RFC, e2e, and operational-skill documentation

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated

Additional verification:

• cargo check -p openshell-core -p openshell-server -p openshell-driver-docker -p openshell-driver-podman -p openshell-driver-kubernetes -p openshell-driver-vm --all-targets
• full library tests for openshell-server, openshell-sandbox, and the Docker, Podman, Kubernetes, and VM compute drivers
• mise run e2e:docker
• mise run ci (Rust and other completed lanes passed; the Go lane encountered three pre-existing gateway-list tests that enumerate the host's installed /etc/openshell/gateways/default in addition to isolated test fixtures)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated
• Public gateway and compute-driver docs updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3110.docs.buildwithfern.com/openshell