feat(docker): prototype supervisor-owned isolation boundaries

[drew]

Summary

Add the Docker proof for RFC 0012's optional supervisor-owned isolation
boundary creation path. This PR is stacked on the host-supervised VM prototype
in #2945 so VM and Docker implementation work can continue independently.

The proof runs the logical supervisor on the host and launches the admitted
agent image directly, without an OpenShell supervisor binary inside the
workload container. It is experimental and does not change the production
Docker compute-driver path.

Stack: #2941 → #2942 → #2945 → this PR.

Related Issue

Part of #1737. Builds on RFC #2048 and the RFC 0012 implementation stack.

Changes

• Extend IsolationBackend with optional supervisor-owned create and
  idempotent destroy operations while preserving attach-only backends.
• Add BackendRegistry::provision so explicit Create and Attach routes
  converge on Bound -> Ready -> Running and return a recovery descriptor plus
  trusted BoundaryOrigin.
• Gate destruction on BoundaryOrigin::SupervisorCreated; externally created
  resources retain compute-driver or orchestrator ownership.
• Add a Linux-only experimental DockerIsolationBackend that creates the
  container stopped, disables networking, drops all capabilities, and starts
  the workload only after standing enforcement is ready.
• Install an OCI seccomp-notify profile, receive runc's listener FD over
  SCM_RIGHTS, validate listener metadata and container identity, and deny
  delegated syscalls from the host with EPERM.
• Validate topology identity and Docker labels before attach or destruction,
  and remove container/listener resources through retry-safe cleanup.
• Update RFC 0012 and the Docker driver README with the create/attach ownership
  model, limitations, and local-daemon smoke command.
• Default SCCACHE_DIR to one user-level OpenShell cache shared by worktrees
  while preserving caller overrides.

Testing

• mise run pre-commit passes in full; environment-level TypeScript and
  cache-server restrictions prevented a complete run in this task.
• cargo clippy -p openshell-isolation -p openshell-driver-docker -p openshell-sandbox --all-targets -- -D warnings
• cargo test -p openshell-isolation (25 passed)
• Docker isolation unit/contract tests (7 passed)
• Real Docker seccomp-notify smoke; /var/run/docker.sock is absent on the
  current host, so the ignored daemon test was not executed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• RFC and crate documentation updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2965.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.