test(tmachine): support package-installed Podman driver suites

[elezar]

Summary

Podman driver suites currently assume the binary installer's CLI path, HTTP registration, configuration file, and system service. Reuse the installed gateway's context so the same suites preserve HTTPS client credentials and target the correct configuration and service when run against native packages. Switch the three Fedora driver-specific branch lanes to RPMs.

Related Issue

No issue required: scoped test-harness maintenance fixes installer assumptions in existing qualification suites; product behavior and public APIs are unchanged. Builds on the package qualification work merged in #4025 and #4056.

Changes

• Publish non-secret gateway metadata from the shared client registration role; resolve the installed CLI from PATH and retain the existing registration and credentials.
• Apply namespace fixtures to the active gateway config's Podman table, restart the matching system/user service, and check authenticated healthy readiness.
• Collect journals for the matching service and UID, including root's packaged user service.
• Preserve default, auto, keep-id, and explicit private UID/GID mapping coverage in rootful and rootless modes. Resolve the rootless E2E socket/UID and use the installed gateway's network name.
• Document supported environments and cache behavior.

Testing

• mise run pre-commit passes (the unrelated, untracked pr-issue-summary.md was temporarily kept outside check inputs).
• Ansible syntax checks for the binary, DEB, RPM, and all Podman suite entry points; workflow actionlint and matrix validation; git diff --check.
• Representative tmachine guest checks: actual Ubuntu/Docker DEB installation, HTTPS registration, metadata loading, packaged user-service restart, authenticated readiness, and journal collection.
• Fedora binary installer fixture checks in rootful and rootless Podman: default, auto, keep-id, and explicit private mappings, healthy gateway readiness after config changes, and system-service journal collection. Candidate binaries were extracted from the existing DEB artifact and supplied explicitly to the normal binary installer in a temporary validation config.
• Real RPM installation and full driver-podman/e2e-podman nextest archive runs: candidate RPMs and those archives were absent locally. The fixture checks above capture direct Podman mappings and verify gateway configuration loading, but do not run the missing archive's OpenShell-versus-reference comparisons.

Full local CI was attempted. After using the existing Nix Z3 library via LIBRARY_PATH, mise run ci reached the Rust tests and stopped in five existing openshell-driver-vm tests because mke2fs/mkfs.ext4 (e2fsprogs) are unavailable on this host. Full CI is not reported as passing.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Test/CI documentation updated; crate architecture documentation is not applicable.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4107.docs.buildwithfern.com/openshell

[elezar]

/ok-to-test 0ab64f3

[SDAChess]

Closes #3454

[github-actions]

Label test:e2e applied, but pull-request/4107 does not exist yet. A maintainer needs to comment /ok to test 0ab64f359c42d7e97e018599137c62d145e1eaaf to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.