[Jaana Dogan (rakyll)]

This removes a set of features that widened what ate-env-api
and the guest can be made to do, without review in proportion
to that reach. Our goal for this project is to keep the data
plane APIs to a minimum and see if we can provide the guest
services from Substrate actors only via config in the long-term.

Removed:

• Runtime layers and sidecars: ate-env manifest template --layer,
  --sidecar and --sidecar-readyz, and the guest's -sidecar and
  -sidecar-readyz support (cmd/ate-env-guest/sidecar.go). /readyz
  answers once the guest is listening.
• Port proxy (internal/portproxy) and its ate-env-api flags
  --atenet-connect, --port-proxy-trusted-origins and
  --port-proxy-response-header-timeout, plus the CONNECT support in
  the fake router.
• On-demand rootfs images: CreateEnvironmentRequest.rootfs_image
  (field 4 and its name are now reserved), the server-side derivation
  of <base>-<digest> ActorTemplates, ate-env create --rootfs-image,
  and rootfs_image= in the Python client. ate-env manifest template --rootfs-image stays: operators can still register image templates
  themselves.
• The NeMo Gym integration (integrations/nemo-gym), which depended on
  the port proxy and on runtime layers.
• SWE-bench benchmarking (cmd/benchmarking, internal/benchmarking,
  benchmarking/), which depended on on-demand rootfs images.
• Docs for all of the above: docs/rootfs-images, examples/runtime-layers,
  and the related README sections.
• CreateEnvironment now returns InvalidArgument when the request has
  unknown fields. The message names the replacement: register an image
  template with ate-env manifest template --rootfs-image and pass its
  name in template.name.

Process:

Changes of this size to a project like this, which adds new network
surface, new privileges for the API service, new wire-protocol fields,
and new integrations, need substantial design discussion and security
review before they are merged. They should not land incrementally
through feature PRs. Any of these capabilities can come back through a
design proposal with a threat model and explicit maintainer sign-off.

Compatibility:

• Clients that set rootfs_image get an environment created from the
  base template, because the server drops the unknown field. Update
  them.
• ate-env-api deployments that pass the removed port-proxy flags will
  fail to start; the generated manifest never set them.
• Templates derived by earlier versions (<base>-<12 hex>) are unused
  and can be deleted with kubectl-ate delete actor-template.

[Jaana Dogan (rakyll)]

The identical change is approved in #109 (comment), we cannot amend the commit there to add the DCO required commit sign-off. This PR signs the commit to pass the DCO check. #115 will be closed.

[Tomer Glottmann (tomergee)]

Verdict: approve. This PR carries the same change as #109, which I reviewed and approved. Head d02e05e has tree 5dff01cf, byte-identical to #109 head 6ee7e08, on the same base fccd920. The only difference is the Signed-off-by trailer, and the DCO check passes.

The reviews of #109 apply in full: the first review at #109 (review) and the approval at #109 (review).

Verified on 6ee7e08, same tree as d02e05e

• go build ./..., go vet ./..., go test ./... pass. go mod tidy changes nothing. staticcheck is clean.
• Python 3.12: 116 passed, 26 skipped. ruff check clients/python is clean.
• buf generate leaves the Go stubs unchanged. gen-protos.sh reproduces the Python stubs.
• grpc-go v1.84.0 keeps unknown fields on unmarshal, thus CreateEnvironment sees field 4 from an old client and returns InvalidArgument.
• CI on #116: Go, Python, cla/google and DCO pass. The zizmor and Wiz checks did not run for this fork PR. They passed on the identical tree in #109.

Nits, no action needed for merge

1. Commit message and PR description, "Compatibility", first bullet: it says the server drops the field. The server returns InvalidArgument. Fix the text before the squash merge.
2. The comment above says "#115 will be closed". #115 is an unrelated issue. The intended number is #109.
3. The three code nits from the #109 review stand: internal/apiservice/server.go:106, README.md:79-83, and the CLI-only helpers in internal/apiservice/imagetemplate.go.