refactor(compute): register compiled drivers

[drew]

Summary

Replace the gateway's closed-world compute-driver selection with an explicit compiled-driver registry modeled after SQLx's Any driver installation. The openshell-gateway binary crate owns first-party driver composition, leaving openshell-server and openshell-core independent of compute-driver implementations. The same drivers can also run as external binaries over the public compute-driver RPC contract.

Related Issue

Part of #2417.

Stacked on #2744.

Changes

• add public ComputeDriverRegistry, ComputeDriverRegistration, and ComputeDriverFactory composition APIs
• add openshell-gateway as the standard binary/composition crate and gate first-party registrations behind in-tree-compute-drivers
• package the composed binary as openshell-gateway and update build, release, deployment, and development references
• remove compute-driver crate dependencies and backend construction from openshell-server
• remove ComputeDriverKind and compute-backend construction details from openshell-core
• define gateway-owned shutdown/startup as compile-time registration metadata: Docker, Podman, and VM opt in; Kubernetes and unknown external drivers default to operator-owned lifecycle
• preserve registration metadata when a registered name is replaced by an external socket endpoint
• move VM process launch and first-party Docker, Podman, Kubernetes, and VM registration to the gateway composition boundary
• add standalone public-RPC servers for Docker, Podman, and Kubernetes; VM already exposes the same service
• add a driver-free gateway build and dependency-graph check
• reject ComputeDriverKind, ComputeDriverFeature, and compute-driver implementation leakage in openshell-core and openshell-server
• add external-driver E2E tasks for Docker, Podman, Kubernetes, and VM and run them in branch CI
• retain architecture documentation only; public docs/ content remains unchanged

Process identity is not configurable and does not use registration metadata or a driver capability. Omitted identity fields remain omitted for every driver by default. This PR adds no public protobuf messages or gateway configuration fields.

Kubernetes terminology remains in server code only where the server itself implements Kubernetes API authentication, certificates, or credential storage—not compute backend construction or lifecycle behavior.

Testing

• mise run pre-commit
• bash e2e/no-compute-driver-gateway.sh
• cargo test -p openshell-gateway (16 passed)
• focused registry selection and endpoint-override tests
• focused shutdown/startup registration-policy tests
• Docker external-driver smoke E2E (smoke, 1 passed)
• Podman external E2E not run locally (Podman unavailable; covered by CI)
• Kubernetes external E2E not run locally (k3d unavailable; covered by CI)
• VM external E2E not run locally (covered by CI on the KVM runner)

Checklist

• Changes are scoped to the accepted issue
• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture documentation is updated
• Public-facing documentation remains unchanged
• PR remains draft

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2786.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied, but pull-request/2786 is at b8659a8 while the PR head is 0862fc2. A maintainer needs to comment /ok to test 0862fc22b855cf8e296df7355c2fcd1d9aba92d6 to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.