chore(deps): upgrade OpenShell to v0.1.6 - #13961

Failure

NemoClaw pins OpenShell v0.1.5 (bdb956f). v0.1.6 (ac7f615, 68 commits later) is the latest release. It brings:

• the webpki update that stops trusting the compromised emSign authorities (CVE-2026-111943), russh 0.64.1 (CVE-2026-111061), and the Tokio, crypto-bigint, and ctutils fixes for RUSTSEC-2026-0385 to 0387;
• a fix for lifecycle operations stalling on unrelated sandboxes while the gateway checks a busy sandbox's provisioning deadline;
• sandboxes that open the control connection to their supervisor.

Decision

This is a plain version upgrade; no NemoClaw behavior change is intended.

• Pins:

  • the Cargo revision for openshell-core, openshell-sdk and openshell-policy, and for the vendored SDK's openshell-core and openshell-crypto;
  • versions.json: version, revision, the gateway, supervisor and sandbox images, and the gateway chart;
  • the managed-gateway reference and a contract test, which carry the gateway digest.

  Digests come from GHCR's 0.1.6 tags. GHCR's 0.1.5 tags match the previous pins. The images carry no OCI revision label.

• Vendored SDK: upstream changed README.md, src/client.rs, src/config.rs, src/lib.rs, src/raw.rs, src/transport.rs, src/types.rs and tests/client_mock.rs; they are copied unchanged. Every other vendored source matched upstream v0.1.5. The upstream manifest, LICENSE and THIRD-PARTY-NOTICES are unchanged, so the manifest patch that disables core telemetry stays. NOTICE.md records the refresh.

• Dependency graph: Cargo.lock changes only the revision of the five OpenShell crates; no third-party crate is added or removed.

• Docs: revision links and version claims, checked against v0.1.6:

  • all 25 linked paths exist, and the four heading anchors still match;
  • three line-range links into the gateway configuration reference moved with their text, 32 to 40 lines down;
  • tls: terminate and tls: passthrough are still rejected (l7/mod.rs is unchanged);
  • GPU filesystem additions are still applied inside the workload (enrich_gpu_filesystem_paths in boundary_server.rs).

Upgrade notes checked

• Gateway authentication is now required: managed Docker and Podman gateways already configure gateway JWTs with allow_unauthenticated_users = true (managed/spec.rs), and managed Kubernetes gateways configure OIDC (kubernetes/gateway.rs).
• Control-connection direction: the supervisor and sandbox runtime images move together in versions.json, as the note requires.
• Other notes don't apply: NemoClaw uses neither suspend and resume nor ResumeBoundaryRequest.

Validation

• cargo ci passed locally: fmt, clippy, build, test (1,745), schema, bundle and lifecycle (157).
• cargo ci live-docker (9 tests) and cargo ci live-kind (7 tests) passed on linux_arm64 against the new images.
• cargo deny check licenses sources passes. Advisories show RUSTSEC-2026-0414 in pulldown-cmark 0.13.4, which v1 also has.
• Kubernetes destroys still wait out the sandbox pods' termination grace period: the three-agent Live / Kind test took 79.3 s, against 81 to 85 s on v0.1.5. Kubernetes destroy waits the termination grace period for every sandbox #13959 and bug(sandbox): on Kubernetes, deleting a sandbox waits out the pods' termination grace period OpenShell#5025 stay open.
• Deferred to CI: linux_amd64, macOS and Windows.