docs(rfc): propose sandbox service exposure architecture - #4267

Summary

RFC 0017 proposes a dedicated application listener on supervisors so sandbox HTTP and WebSocket traffic can bypass the gateway and its control connection. This lets operators scale application ingress and configure its access policies separately from gateway management.

The gateway continues to manage service declarations and publishes supervisor-advertised routes through authenticated discovery. Operators can integrate existing ingress with that discovery or use the optional openshell-sandbox-proxy as a reference implementation.

Design

• Make the supervisor app listener the core feature, with hostname routing to sandbox services under each sandbox's policy.
• Support Kubernetes ingress plus a discovery adapter routing to supervisor Services.
• Accommodate future shared supervisors while preserving distinct sandbox policies.
• Preserve existing service commands and gateway routing for simple deployments.
• Leave TLS termination, ingress policy, discovery authorization, and route lifecycle details open for review.

Validation

• Repository Markdown lint passes.
• Diff whitespace checks pass.
• RFC-only change; no runtime implementation.

Related issue

Closes #4266

Related work

• feat: sandbox ingress — expose services from inside the network namespace #994 and Support Kubernetes-native Service/Endpoint exposure for sandbox agents #1791: service declarations, supervisor enforcement, and Kubernetes-native exposure.
• feat(gateway): separate control-plane and service-ingress listeners #4210 / feat(gateway): separate control-plane and service-ingress listeners #4213: separate gateway listeners, an alternative that retains gateway payload traffic.
• Option to pass through external Authorization headers without replacement #1794 and feat: expose sandbox services during creation #3402: bearer authentication and create-time exposure workflows to preserve.
• feat(services): continuously observe HTTP application readiness #4229: service readiness, kept distinct from route authorization.
• feat(helm): support agentgateway ingress #2469 and feat(helm): support shared agentgateway Gateway #3715: dedicated/shared ingress integrations that could use supervisor listeners and discovery.