feat(gateway): support runtime image env overrides

[elezar]

🏗️ build-from-issue-agent

Summary

Add gateway-process overrides for the trusted sandbox-runtime and supervisor images used by the built-in Docker, Podman, and Kubernetes drivers. They follow the gateway's established CLI > environment > TOML > built-in default contract; because the gateway has no image CLI flags, its effective order is process environment > driver TOML > compiled default.

Related Issue

Closes #3502

Changes

• Make OPENSHELL_SANDBOX_RUNTIME_IMAGE and OPENSHELL_SUPERVISOR_IMAGE process-level overrides of the existing shared runtime-image defaults.
• Apply the gateway environment after driver TOML deserialization, matching existing gateway configuration precedence.
• Add equivalent CLI/environment image options to the standalone Docker driver, matching standalone Podman and Kubernetes behavior.
• Keep environment values on the same pass-through path as equivalent TOML fields; add no separate OCI parser or image-value logging.
• Keep trusted image fields outside sandbox request schemas.
• Convert the shared Debian/RPM package qualification role to inject exact candidate images through packaged gateway.env without generating operator TOML.
• Move tmachine Docker/Podman trusted-image selection from gateway TOML into the gateway service environment, including the Nix development Podman service.
• Document precedence, pass-through behavior, supported drivers, package delivery, and trust implications.

Testing

• mise run pre-commit
• Focused Rust formatting and compilation
• Default-resolution unit test
• Environment-over-TOML precedence test
• Docker, Podman, and Kubernetes trusted-image request-boundary tests
• Packaging and tmachine template asset validation
• Installed-package E2E completes in CI

Commands run:

• cargo fmt --all --check
• cargo check -p openshell-core -p openshell-gateway -p openshell-driver-docker -p openshell-driver-kubernetes -p openshell-driver-podman --all-targets
• cargo test -p openshell-core runtime_image_environment_value_replaces_compiled_default
• cargo test -p openshell-driver-docker sandbox_driver_config_rejects_trusted_runtime_image_overrides
• cargo test -p openshell-driver-kubernetes sandbox_driver_config_rejects_trusted_runtime_image_overrides
• cargo test -p openshell-driver-podman sandbox_driver_config_rejects_trusted_runtime_image_overrides
• bash tasks/scripts/test-packaging-assets.sh
• mise run pre-commit

Checklist

• Follows Conventional Commits
• Commit is signed off (DCO)
• Documentation updated
• Related public debugging skill reviewed; no workflow update is required

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3504.docs.buildwithfern.com/openshell