test(e2e): add CLI conformance baseline

[elezar]

Summary

Establish a minimal, portable CLI conformance baseline that certifies the complete CLI -> gateway -> driver deployment path. The standalone conformance task consumes the gateway already selected in the CLI configuration and does not provision a gateway, choose an installation method, or select a compute driver.

Phase 1 contains one hardened smoke scenario. It establishes reusable command execution, polling, diagnostics, explicit resource tracking, and cleanup mechanics before additional lifecycle workflows are considered for conformance.

This is stack 1/2. PR #2873 adds the direct API conformance framework on top.

Related Issue

• spike: driver conformance suite for compute drivers #2183
• Follow-up: test(e2e): add API conformance framework #2873
• Prototype/reference: test(e2e): add API and CLI conformance profiles #2182

Changes

• add the e2e-cli-conformance profile and focused mise run e2e:cli-conformance task
• run the standalone task against an already configured gateway without provisioning one or selecting a driver
• require OPENSHELL_BIN so the suite executes the explicitly selected CLI binary rather than assuming a repository build location
• add an OpenShell-specific runner with generated run identity, fluent command steps, structured results, typed execution errors, JSON parsing, bounded polling, sanitized diagnostics, and focused fake-CLI tests
• make connected gateway status a reusable runner precondition while retaining the human-readable openshell status command as part of the scenario
• create one uniquely named detached sandbox with --from base, verify readiness through sandbox get <name> --output json, verify list visibility, execute a run-specific marker, delete the sandbox, and verify its disappearance
• track the unique sandbox name explicitly and combine functional and cleanup failures through the consuming finish() call; phase 1 does not require labels
• make Docker, Podman, Kubernetes, and VM Cargo features imply CLI conformance so driver wrappers do not repeat the conformance feature
• keep VM overlay and TLS-key permission assertions in the VM-specific vm_overlay target
• document the phase-1 contract and interrupted-run resource recovery procedure

Testing

• 14 focused conformance helper tests
• 36 complete E2E harness library tests
• smoke target compilation with only e2e-cli-conformance enabled
• smoke target compilation through Docker, Podman, Kubernetes, and VM driver features
• strict Clippy for the helper library and smoke target
• shell syntax checks for the affected driver wrappers
• complete mise run pre-commit
• missing-gateway precondition fails immediately without attempting sandbox cleanup
• live driver-backed smoke run (no gateway is currently selected in the local CLI configuration)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Conformance is independent of gateway installation method and compute driver
• Driver-specific assertions remain outside conformance
• Cleanup is scoped to the explicitly tracked, uniquely named sandbox
• Documentation updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/2871 does not exist yet. A maintainer needs to comment /ok to test 4180d62b99b1e3d9891f8281cd0a1adb2e10ac3b to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[elezar]

Closing unmerged: superseded by #2925, which now carries the full conformance/e2e stack against main through 2a2e632.