chore: merge upstream main into feat/supervisor-otlp-relay

Resolve Cargo.lock conflict by regenerating the lockfile against the
merged manifests. The branch-side lock still carried the removed
openshell-router crate and a divergent dependency graph.

Signed-off-by: Roland Huß <rhuss@redhat.com>

Author: rhuss

.agents/skills/launch-openshell-gator/SKILL.md

@@ -26,7 +26,7 @@ For gator's PR/issue validation policy, load `gator-gate` inside the launched sa
 |---|---|
 | `scripts/agents/run.sh` | Manifest-driven OpenShell agent launcher. |
 | `scripts/agents/gator/agent.yaml` | Gator manifest: immutable payload version, default gateway, harness, providers, runtime, skills, and subagents. |
-| `scripts/agents/gator/Dockerfile` | Gator sandbox image source. Local launches build this image through OpenShell. |
+| `scripts/agents/gator/Dockerfile` | Gator sandbox image source. Local launches build it in gateway's Docker or Podman image store. |
 | `scripts/agents/gator/policy.yaml` | Sandbox policy for the gator agent. |
 | `scripts/agents/gator/bin/gh` | Gator-specific `gh` wrapper and same-SHA duplicate-post guard. |
 | `scripts/agents/gator/bin/review-feedback-ledger` | Builds tree-aware review scope, durable findings, convergence telemetry, and review-budget state. |
@@ -160,7 +160,7 @@ sandbox_name="gator-pr-${pr_number}-supervised"
   "Review and monitor PR #${pr_number} through the gator-gate workflow. Scope this invocation only to PR #${pr_number}."
 ```
 
-The launcher builds the gator sandbox image when needed, stages the immutable payload, imports provider profiles, configures provider credentials and refresh, creates and uploads the sandbox payload, then starts the agent supervisor with `sandbox exec`. It writes a background log under `scripts/agents/gator/logs/`.
+The launcher queries gateway's selected compute driver, builds gator image in matching Docker or Podman image store, stages immutable payload, imports provider profiles, configures provider credentials and refresh, creates and uploads sandbox payload, then starts agent supervisor with `sandbox exec`. It writes a background log under `scripts/agents/gator/logs/`. `CONTAINER_ENGINE`, when set, must match gateway driver.
 
 ### Launch An Issue Or Issue/PR Pair
 

.agents/skills/sync-agent-infra/SKILL.md

@@ -45,7 +45,7 @@ Use this map when product behavior, commands, or development workflows change. I
 | Sandbox policy schema, presets, or enforcement behavior | `generate-sandbox-policy`, `openshell-cli` |
 | Supervisor middleware policy, registrations, runtime, or failure behavior | `generate-sandbox-policy`, `openshell-cli`, `debug-openshell-cluster` |
 | Gateway deployment, Helm, runtime drivers, or health checks | `debug-openshell-cluster`, `helm-dev-environment` |
-| Inference routing, providers, or `inference.local` behavior | `debug-inference`, `openshell-cli` |
+| Inference providers, native model endpoints, or migration from `inference.local` | `debug-inference`, `openshell-cli`, `generate-sandbox-policy` |
 | TUI architecture, navigation, data fetching, or UX | `tui-development` |
 | Release artifacts or post-publish smoke coverage | `test-release-canary` |
 | GitHub Actions workflows, required checks, or CI diagnostics | `watch-github-actions`; also `test-release-canary` for release smoke coverage |

.github/workflows/publish-docs-website.yml

@@ -25,6 +25,7 @@ permissions:
 concurrency:
   group: docs-website
   cancel-in-progress: false
+  queue: max
 
 defaults:
   run:

.github/workflows/release-dev.yml

@@ -28,6 +28,7 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
     outputs:
       python_version: ${{ steps.v.outputs.python }}
+      docs_version: ${{ steps.v.outputs.docs_version }}
       cargo_version: ${{ steps.v.outputs.cargo }}
       deb_version: ${{ steps.v.outputs.deb }}
       rpm_version: ${{ steps.v.outputs.rpm_version }}
@@ -47,11 +48,15 @@ jobs:
         id: v
         run: |
           set -euo pipefail
-          echo "python=$(uv run python tasks/scripts/release.py get-version --dev --python)" >> "$GITHUB_OUTPUT"
-          echo "cargo=$(uv run python tasks/scripts/release.py get-version --dev --cargo)" >> "$GITHUB_OUTPUT"
-          echo "deb=$(uv run python tasks/scripts/release.py get-version --dev --deb)" >> "$GITHUB_OUTPUT"
-          echo "rpm_version=$(uv run python tasks/scripts/release.py get-version --dev --rpm-version)" >> "$GITHUB_OUTPUT"
-          echo "rpm_release=$(uv run python tasks/scripts/release.py get-version --dev --rpm-release)" >> "$GITHUB_OUTPUT"
+          python_version=$(uv run python tasks/scripts/release.py get-version --dev --python)
+          {
+            echo "python=${python_version}"
+            echo "docs_version=${python_version%%+*}"
+            echo "cargo=$(uv run python tasks/scripts/release.py get-version --dev --cargo)"
+            echo "deb=$(uv run python tasks/scripts/release.py get-version --dev --deb)"
+            echo "rpm_version=$(uv run python tasks/scripts/release.py get-version --dev --rpm-version)"
+            echo "rpm_release=$(uv run python tasks/scripts/release.py get-version --dev --rpm-release)"
+          } >> "$GITHUB_OUTPUT"
 
   build-cli:
     needs: compute-versions
@@ -628,6 +633,22 @@ jobs:
           release-kind: dev
           pin-sha: ${{ github.sha }}
 
+  publish-fern-docs:
+    name: Sync and Publish Fern Docs
+    needs: [compute-versions, release-dev, release-helm, trigger-wheel-publish]
+    permissions:
+      contents: write
+    uses: ./.github/workflows/sync-docs.yml
+    with:
+      operation: sync
+      channel: dev
+      source_ref: ${{ github.sha }}
+      release_version: ${{ needs.compute-versions.outputs.docs_version }}
+      display_name: Dev
+      availability: beta
+      publish: true
+    secrets: inherit
+
   trigger-wheel-publish:
     name: Trigger Wheel Publish
     needs: [compute-versions, release-dev]

.github/workflows/release-tag.yml

@@ -664,31 +664,20 @@ jobs:
           if-no-files-found: error
 
   publish-fern-docs:
-    name: Publish Fern Docs
-    needs: [compute-versions, release]
+    name: Sync and Publish Fern Docs
+    needs: [compute-versions, release, publish-sdk-typescript, release-helm, trigger-wheel-publish]
     if: needs.compute-versions.outputs.is_prerelease != 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ inputs.tag || github.ref }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "24"
-
-      - name: Install Fern CLI
-        run: |
-          FERN_VERSION=$(node -p "require('./fern/fern.config.json').version")
-          npm install -g "fern-api@${FERN_VERSION}"
-
-      - name: Publish Fern docs
-        env:
-          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
-        working-directory: ./fern
-        run: fern generate --docs
+    permissions:
+      contents: write
+    uses: ./.github/workflows/sync-docs.yml
+    with:
+      operation: sync
+      channel: latest
+      source_ref: ${{ needs.compute-versions.outputs.source_sha }}
+      release_version: ${{ needs.compute-versions.outputs.semver }}
+      display_name: Latest (v${{ needs.compute-versions.outputs.semver }})
+      publish: true
+    secrets: inherit
 
   publish-sdk-typescript:
     name: Publish TypeScript SDK

.github/workflows/sync-docs.yml

@@ -4,6 +4,49 @@
 name: Sync Docs Website
 
 on:
+  workflow_call:
+    inputs:
+      operation:
+        description: "Whether to sync or remove a docs snapshot"
+        required: true
+        type: string
+      channel:
+        description: "Docs channel to update or remove"
+        required: true
+        type: string
+      source_ref:
+        description: "Source commit SHA, branch, or tag to snapshot when operation=sync"
+        required: false
+        type: string
+      release_version:
+        description: "Release version used to order mutable channels"
+        required: false
+        type: string
+      version_slug:
+        description: "Version slug when channel=version"
+        required: false
+        type: string
+      display_name:
+        description: "Optional version selector display name"
+        required: false
+        type: string
+      availability:
+        description: "Optional Fern availability status"
+        required: false
+        type: string
+      publish:
+        description: "Publish production docs after syncing"
+        required: false
+        default: false
+        type: boolean
+      allow_rollback:
+        description: "Allow an explicitly requested mutable-channel rollback"
+        required: false
+        default: false
+        type: boolean
+    secrets:
+      FERN_TOKEN:
+        required: false
   workflow_dispatch:
     inputs:
       operation:
@@ -21,26 +64,46 @@ on:
         options:
           - dev
           - latest
+          - stable
           - version
       source_ref:
         description: "Source commit SHA, branch, or tag to snapshot when operation=sync"
         required: false
         type: string
+      release_version:
+        description: "Release version, e.g. 0.1.2 or 0.1.3.dev4"
+        required: false
+        type: string
       version_slug:
         description: "Version slug when channel=version, e.g. v0.0.36"
         required: false
         type: string
       display_name:
-        description: "Optional version selector display name"
+        description: "Optional selector name, e.g. Dev"
+        required: false
+        type: string
+      availability:
+        description: "Optional Fern status: beta, deprecated, ga, or stable"
         required: false
         type: string
+      publish:
+        description: "Publish production docs after syncing"
+        required: false
+        default: false
+        type: boolean
+      allow_rollback:
+        description: "Allow an explicitly requested mutable-channel rollback"
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: write
 
 concurrency:
   group: docs-website
   cancel-in-progress: false
+  queue: max
 
 defaults:
   run:
@@ -65,15 +128,20 @@ jobs:
           OPERATION: ${{ inputs.operation }}
           CHANNEL: ${{ inputs.channel }}
           SOURCE_REF: ${{ inputs.source_ref }}
+          RELEASE_VERSION: ${{ inputs.release_version }}
           VERSION_SLUG: ${{ inputs.version_slug }}
         run: |
           set -euo pipefail
           if [[ "$OPERATION" == "sync" && -z "$SOURCE_REF" ]]; then
             echo "source_ref is required when operation=sync" >&2
             exit 1
           fi
-          if [[ "$CHANNEL" == "version" && -z "$VERSION_SLUG" ]]; then
-            echo "version_slug is required when channel=version" >&2
+          if [[ "$CHANNEL" =~ ^(dev|latest|stable)$ && -z "$RELEASE_VERSION" ]]; then
+            echo "release_version is required for dev, latest, and stable channels" >&2
+            exit 1
+          fi
+          if [[ "$CHANNEL" =~ ^(stable|version)$ && -z "$VERSION_SLUG" ]]; then
+            echo "version_slug is required for stable and version channels" >&2
             exit 1
           fi
 
@@ -96,6 +164,7 @@ jobs:
         uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
         with:
           version: "0.10.12"
+          python-version: "3.13"
 
       - name: Update docs snapshot
         # Inputs flow in as quoted env vars to avoid shell injection; see the
@@ -104,17 +173,32 @@ jobs:
           OPERATION: ${{ inputs.operation }}
           CHANNEL: ${{ inputs.channel }}
           SOURCE_REF: ${{ inputs.source_ref }}
+          RELEASE_VERSION: ${{ inputs.release_version }}
           VERSION_SLUG: ${{ inputs.version_slug }}
           DISPLAY_NAME: ${{ inputs.display_name }}
+          AVAILABILITY: ${{ inputs.availability }}
+          ALLOW_ROLLBACK: ${{ inputs.allow_rollback }}
         run: |
+          SOURCE_SHA=""
+          if [[ "$OPERATION" == "sync" ]]; then
+            SOURCE_SHA=$(git -C source rev-parse HEAD)
+          fi
+          rollback_args=()
+          if [[ "$ALLOW_ROLLBACK" == "true" ]]; then
+            rollback_args+=(--allow-rollback)
+          fi
           uv run automation/tasks/scripts/sync_docs_website.py \
             --operation "$OPERATION" \
             --source-root source \
             --docs-website-root docs-website \
             --channel "$CHANNEL" \
             --source-ref "$SOURCE_REF" \
+            --source-sha "$SOURCE_SHA" \
+            --release-version "$RELEASE_VERSION" \
             --version-slug "$VERSION_SLUG" \
-            --display-name "$DISPLAY_NAME"
+            --display-name "$DISPLAY_NAME" \
+            --availability "$AVAILABILITY" \
+            "${rollback_args[@]}"
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -160,3 +244,10 @@ jobs:
             git commit -m "docs(website): remove ${target} docs"
           fi
           git push origin HEAD:docs-website
+
+      - name: Publish Fern docs
+        if: ${{ inputs.publish }}
+        env:
+          FERN_TOKEN: ${{ secrets.FERN_TOKEN }}
+        working-directory: docs-website/fern
+        run: fern generate --docs