feat(firecracker): prototype host-supervised isolation

[drew]

Summary

This is just a prototype to prove out RFC-0012. No immediate plans to merge.

Adds an experimental Firecracker Isolation Backend and external gateway compute driver on top of the RFC 0012 implementation. The logical supervisor remains on the host, while a private mode of the same driver binary invokes the existing process-supervisor implementation inside a no-NIC guest over authenticated virtio-vsock.

mise run gateway:firecracker now starts a plaintext local gateway wired to that external driver without sudo. If the account already belongs to the kvm group but the current shell has stale supplementary groups, the runner re-executes itself with sg kvm.

This remains a prototype: it boots the configured ext4 fixture rather than materializing the requested OCI image. Stop, exec, PTY, port forwarding, mediated egress, restart recovery, and per-connection binary identity remain explicit fail-closed follow-ups.

Related Issue

Part of #1737. Prototype follow-on to #2048, stacked on an exact mirror of its implementation branch.

Changes

• Add a single openshell-driver-firecracker crate for Firecracker launch, RFC backend lifecycle, gateway ComputeDriver service, private host-to-guest transport, and guest process-supervisor mode.
• Generalize the existing RFC supervisor path to select the admitted firecracker backend while retaining the current logical supervisor model outside the VM.
• Send the admitted sandbox policy and workload specification to the guest only after attach -> confirm -> start_agent.
• Launch workloads through openshell-supervisor-process with full process enforcement and a driver-resolved numeric identity.
• Attach no guest NIC, eliminating TAP, nftables, CAP_NET_ADMIN, and sudo requirements; host access is limited to /dev/kvm.
• Add mise run gateway:firecracker, which builds the gateway, supervisor, and driver; generates local credentials; registers the active gateway; and connects the external driver over a private Unix socket.
• Add mise run e2e:firecracker, which clones the rootfs fixture, injects the current driver, boots a real VM, and validates the lifecycle through process exit.
• Update architecture, development-runner, and cluster-debugging documentation without changing existing VM driver behavior.

Testing

• mise run pre-commit
• cargo test -p openshell-driver-firecracker -p openshell-sandbox (145 passed, 3 privileged namespace helpers ignored)
• mise run e2e:firecracker (real Firecracker v1.16.1 on KVM)
• mise run gateway:firecracker, followed by gateway status and info checks confirming a healthy external firecracker compute driver
• Direct runner invocation verified automatic sg kvm re-exec with no sudo
• Runner startup with BINDGEN_EXTRA_CLANG_ARGS unset, verifying automatic GCC architecture-header discovery through the sg kvm transition

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.