refactor(supervisor): add backend-neutral boundary primitives

[drew]

Summary

Add permanent backend-neutral boundary primitives to the process and network supervisor leaves while preserving the legacy orchestration path. This is PR 2 of 4 in the review stack.

Stack: #2941 → this PR → #2945 → #2965.

The supervisor primitives consume the single RFC 0012 entry path introduced below: resolve the trusted topology descriptor, call attach, then drive Bound → Ready → Running.

Review-only prototype: The original code author is @jganoff, and the original implementation source is jganoff/OpenShell:jganoff/rfc-0012-impl. This reconstructed stack is for reviewing and prototyping RFC 0012; we do not intend to merge these PRs. The stack is rebased onto current main and integrated with the current canonical process and networking architecture.

Related Issue

Part of #1737. The final PR in this stack carries the Docker proof.

Changes

• Add boundary-owned process, exec, PTY, signal, wait, and cleanup primitives around the canonical main-process session.
• Allow network mediation to consume an optional backend-provided source without removing transparent TCP or legacy listeners.
• Add the focused openshell-binary-identity helper crate for shared trusted procfs executable resolution.
• Resolve binary identity before mediation and fail closed on unresolved ownership.
• Preserve provider credential state and backend-provided host-gateway routes in shared network enforcement.
• Add strict network-namespace egress-ceiling installation and verification APIs.
• Retain legacy networking with explicit absent mediation sources.

Testing

• Contract, supervisor process, supervisor network, and sandbox crates compile together
• cargo test -p openshell-supervisor-network --lib — 1,268 passed, 2 ignored on the complete stack
• cargo test -p openshell-sandbox --lib — 102 passed on the complete stack
• mise run pre-commit passes on the complete stack

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated by the contract and implementation layers

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.