feat(sandbox): add main restart policy

[drew]

Summary

Add a gateway-owned restart policy for the canonical sandbox main process introduced by #2726. Sandboxes default to Never and may opt into Kubernetes-style OnFailure or Always replacement with durable exponential backoff.

This is the second PR in the stack and must be reviewed after #2726.

Related Issue

Relates to #2710.

Depends on #2726.

Changes

• Add Never, OnFailure, and Always restart policies plus the Restarting sandbox phase.
• Persist restart count, scheduling deadline, and main-process start time on sandbox status.
• Implement gateway-owned replacement, exponential backoff, HA-safe reconciliation, readiness recovery, and manual stop cancellation.
• Clear VM stop and terminal tombstones on explicit replacement start so a prior main exit cannot poison later driver recovery.
• Preserve the original main-process start time when the same supervisor instance reconnects; reset it only for a new instance.
• Keep native runtime restart disabled across Docker, Podman, Kubernetes, and VM drivers.
• Surface policy and restart status through the CLI, TUI, SDKs, published docs, and agent guidance.

Testing

• mise run pre-commit
• mise run test with an isolated system-gateway directory
• Focused VM tombstone and gateway reconnect stability-clock tests
• Docker sandbox lifecycle E2E: 6 passed, covering retained reconnect/history and Ready to Restarting to replacement Ready with workspace preservation
• Agent infrastructure inventory and cross-reference consistency checks

The unmodified host environment contains /etc/openshell/gateways/default, so the no-config completer test requires an isolated OPENSHELL_SYSTEM_GATEWAY_DIR; the full suite passes with that isolation.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture and user documentation updated
• Related CLI and TUI agent guidance updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2798.docs.buildwithfern.com/openshell