test(tmachine): use K3s ClusterIP, wait for gateway, add failure diagnostics

[matthewgrossman]

Summary

Connect tmachine K3s conformance clients directly to the gateway's ClusterIP Service, removing the long-lived kubectl port-forward process. The CLI runs on the K3s node inside the guest, so no external exposure is needed.

This PR also adds two net-new behaviors:

• Shared gateway wait (all installers). Before conformance, the shared conformance playbook waits up to five minutes for openshell status to report a connected gateway. Every test boot restarts the gateway; installers that are already up pass immediately. If the gateway never connects, conformance is skipped, diagnostics are collected, and the run fails with a clear message instead of per-scenario preflight failures.
• Failure diagnostics. On conformance or gateway-wait failure, one openshell_diagnostics role collects the systemd gateway journal (moved from cli.yaml) and, when K3s is installed, bounded K3s diagnostics: K3s journal, API readiness, nodes, gateway Pod state, Services, EndpointSlices, iptables Service rules (nft and legacy), gateway events and current/previous logs, and CLI status. Integration Tests uploads the K3s diagnostics as tmachine-diagnostics-* artifacts.

Related Issue

Closes #4254. Replaces the closed NodePort draft #4255.

Changes

• openshell-k3s.yaml: replace the port-forward unit with ClusterIP and gRPC port discovery, registered once through the existing openshell_client role. Recreating the Service requires reprovisioning the fixture.
• conformance/cli.yaml: add the shared gateway wait; replace inline gateway-log tasks with the shared diagnostics role behind a single conformance_failed condition.
• roles/openshell_diagnostics/: new shared diagnostics role and K3s collection script.
• integration-runner.yml: upload diagnostics artifacts.
• CI.md: short note on the K3s lane, the shared wait and diagnostics.

No chart, runtime or tmachine Rust changes. Install-time diagnostics are intentionally out of scope; Helm install failures surface through normal Ansible output.

Testing

• Ansible syntax checks (openshell-k3s.yaml, conformance/cli.yaml, conformance/policy-advisor.yaml) and shellcheck pass.
• Local Ansible logic check of the shared wait with a stub CLI: connected + passing tests runs clean; connected + failing tests collects diagnostics and fails on conformance; never-connected skips conformance, collects diagnostics and fails on the gateway wait.
• ClusterIP jsonpath verified against a sample Service (10.43.206.224:8080; headless None:8080 rejected).
• Earlier local tmachine K3s validation (ARM64 QEMU/HVF) of the ClusterIP transport passed 8/8 conformance tests and kept the registration across gateway Pod replacement. That run predates the shared wait and diagnostics restructure.
• Branch E2E run 37968718738 on head 1767ec0 passed, including all four conformance integration lanes (ubuntu-k3s, deb, rpm rootful, rpm rootless) and the feature- and driver-specific lanes. Failure diagnostics do not run on a passing run; the failure path is covered by the local stub check above.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant CI guidance updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[matthewgrossman]

/ok to test b14566a

[github-actions]

Label test:e2e applied for b14566a. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[matthewgrossman]

/ok to test 1767ec0