feat(kubernetes): adopt shared supervisor boundary mode

[drew]

Summary

Rework the review-only Kubernetes proxy-pod adapter to provision the same shared openshell-sandbox --mode=control / --mode=boundary protocol used by VM and Docker. The proxy pod hosts control; the workload pod hosts the boundary beside the agent.

This is PR 6 of 6. Its incremental code diff is confined to crates/openshell-driver-kubernetes.

Stack: #2941 → #2942 → #3151 → #2945 → #2965 → this PR.

Related Issue

Part of #1737. Informed by the proxy-pod implementation in #2885. The issue does not currently carry state:accepted or roadmap placement; this implementation proceeds under direct maintainer instruction without changing those labels.

Changes

• Remove the duplicated Kubernetes-specific backend protocol in favor of the common RFC 0012 boundary protocol.
• Provision authenticated TCP transport for the cross-pod control/boundary connection.
• Bind the topology to namespace, workload Pod, proxy Pod, and egress NetworkPolicy UIDs plus the policy resource version.
• Run proxy-pod control outside the workload trust boundary and workload-pod boundary beside the agent.
• Use the shared exec, signal/terminate, wait, PTY, loopback-forwarding, binary-identity, and mediated-egress capabilities.
• Require the boundary to protect bootstrap configuration before launching the workload.

Kubernetes resource rendering and active driver registration remain follow-up work. This PR remains review-only and does not expose a selectable topology.

Testing

• mise run pre-commit on the complete stack
• cargo test -p openshell-driver-kubernetes — 231 passed
• cargo clippy -p openshell-driver-kubernetes --all-targets -- -D warnings
• Kubernetes e2e is not applicable until resource rendering and registration are implemented

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Incremental diff is confined to the Kubernetes driver crate

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.