feat(firecracker): prototype host-supervised isolation - #2934

Summary

This is just a prototype to prove out RFC-0012. No immediate plans to merge.

Adds an experimental Firecracker Isolation Backend and external gateway compute driver on top of the RFC 0012 implementation. The logical supervisor remains on the host, while a private mode of the same driver binary invokes the existing process-supervisor implementation inside a no-NIC guest over authenticated virtio-vsock.

mise run gateway:firecracker now starts a plaintext local gateway wired to that external driver without sudo. If the account already belongs to the kvm group but the current shell has stale supplementary groups, the runner re-executes itself with sg kvm.

This remains a prototype: it boots the configured ext4 fixture rather than materializing the requested OCI image. Stop, exec, PTY, port forwarding, mediated egress, restart recovery, and per-connection binary identity remain explicit fail-closed follow-ups.

Related Issue

Part of #1737. Prototype follow-on to #2048, stacked on an exact mirror of its implementation branch.

Changes

• Add a single openshell-driver-firecracker crate for Firecracker launch, RFC backend lifecycle, gateway ComputeDriver service, private host-to-guest transport, and guest process-supervisor mode.
• Generalize the existing RFC supervisor path to select the admitted firecracker backend while retaining the current logical supervisor model outside the VM.
• Send the admitted sandbox policy and workload specification to the guest only after attach -> confirm -> start_agent.
• Launch workloads through openshell-supervisor-process with full process enforcement and a driver-resolved numeric identity.
• Attach no guest NIC, eliminating TAP, nftables, CAP_NET_ADMIN, and sudo requirements; host access is limited to /dev/kvm.
• Add mise run gateway:firecracker, which builds the gateway, supervisor, and driver; generates local credentials; registers the active gateway; and connects the external driver over a private Unix socket.
• Add mise run e2e:firecracker, which clones the rootfs fixture, injects the current driver, boots a real VM, and validates the lifecycle through process exit.
• Update architecture, development-runner, and cluster-debugging documentation without changing existing VM driver behavior.

Testing

• mise run pre-commit
• cargo test -p openshell-driver-firecracker -p openshell-sandbox (145 passed, 3 privileged namespace helpers ignored)
• mise run e2e:firecracker (real Firecracker v1.16.1 on KVM)
• mise run gateway:firecracker, followed by gateway status and info checks confirming a healthy external firecracker compute driver
• Direct runner invocation verified automatic sg kvm re-exec with no sudo
• Runner startup with BINDGEN_EXTRA_CLANG_ARGS unset, verifying automatic GCC architecture-header discovery through the sg kvm transition

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)