feat(gateway): broker stable sandbox SPIFFE provider tokens - #4732

Summary

Let the shared Kubernetes supervisor obtain provider tokens using each sandbox's stable SPIFFE identity. The gateway owns SPIRE access, JWT-SVIDs, intermediate credentials, and provider exchanges. The supervisor authenticates with the individual sandbox generation's JWT and receives only the final provider access token; workloads receive no SPIFFE socket or credentials.

Based on main, which includes #4701 and #4702. The supervisor token authorizes only the private supervisor-initiated assignment stream over server-authenticated TLS. Provider-token requests require the individual sandbox's generation-bound credentials; no client mTLS or new Kubernetes authentication is introduced.

Closes #4731

Changes

• Add sandbox-authenticated GetSandboxProviderAccessToken. The gateway verifies the signed session, persisted generation, credential epoch, token lineage, and active state. Attachment, endpoint, audience, and scopes come from trusted configuration.
• Require the exact configured credential key, including endpoint ownership, after removing supported supervisor revision/installation decorations. Fingerprint the matched key, sandbox generation, epoch, provider revision, grant, and resolved subject through openshell-crypto; caller spelling cannot manufacture cache entries, and in-place subject rotation invalidates reuse.
• Derive <prefix>/gateway/<gateway-id>/sandbox/<sandbox-id> from verified identity. Require the expected JWT-SVID and verify its signature, audience, and expiry against the agent's current trust bundle. Stop/start preserves identity; recreating the sandbox changes it.
• Isolate SPIRE transport, delegated API messages, selectors, and JWT-SVID verification in openshell-spire. Shared SPIFFE types, parsing helpers, stable identity mapping, and SandboxIdentityProvider live in dependency-light openshell-spiffe, independently of core and SPIRE. The gateway broker uses that interface to request a verified stable sandbox identity, token, and expiry; startup selects the adapter through the existing configuration. Authorization, exchanges, and caching remain in the gateway.
• Perform RFC 7523 grants or both RFC 8693 stages on the gateway. Coordinate concurrent misses per fingerprint with cancellation-safe cleanup and a cache recheck; unrelated credentials acquire independently.
• Bound broker token lifetimes by issuer expiry, a parseable JWT expiry used only as a shortening bound, session/SVID/subject expiry, and cache policy. Broker TTL overrides can shorten the default lifetime but cannot extend it; zero disables caching. Responses report the effective remaining lifetime after final checks. The dedicated supervisor's exact-override semantics remain unchanged.
• Reuse one lazily connected authenticated channel per sandbox with bearer rotation and revocation. Bound the whole client operation at 135 seconds, the broker at 120 seconds, identity calls at 10 seconds, and each token-service request at 30 seconds.
• Keep subject resolution before cache lookup and preserve authorization around remote operations and final configuration/session validation on hits and misses. Attribute sanitized failures to the authenticated sandbox's logs. No supervisor-side token cache is added.
• Configure delegation under openshell.gateway.spiffe_delegation, mounting the private admin socket only on the gateway. Conditional Helm notes and deployment guidance cover hostPath admission exceptions, socket startup/permissions, chart-applied groups, and registration coverage for all eligible agents. E2E assertions handle malformed request IDs, all container classes, and retry duplicates.

SPIRE trusts the gateway as a delegate. Operators provision registrations within the eligible agents' scope, using node aliases/sets or corresponding per-agent entries. The opt-in hostPath requires explicit admission permission; this does not make the mount compatible with unmodified Baseline/Restricted policy or restricted-v2 SCC. There is no automatic registration, supervisor HA, other-driver enablement, or validated Kata support. Already-issued provider bearer tokens retain their normal expiration.

Validation

• Formatting, Cargo lockfile checks, and all-target Clippy with -D warnings for core, supervisor-network, server, and gateway, including server test-support.
• 669 focused Rust tests passed, including canonical keys, cache fingerprints, lifetime bounds, concurrent acquisition/cancellation, and client deadlines.
• 367 Helm tests passed, plus Helm lint, rendered Rust configuration parsing, chart ownership/coherence checks, and a client-only install confirming conditional prerequisite notes.
• The live SPIRE 1.15.4 fixture passed (mise run test:spire-delegation), exercising delegated identity selection and failure cases against a real local server and agent.
• Shared-supervisor SPIFFE Kubernetes E2E compiles. Seven extracted Python-helper scenarios passed. Full Kubernetes/SPIRE E2E execution was not run.

The adapter extraction additionally passed all-target Clippy, the moved SPIFFE tests, 583 focused server tests, and its focused adapter test. The live SPIRE fixture passed four consecutive runs after adding a wait for delegate issuance. The combined stack passed 2,956 affected tests (22 skipped) and the Kubernetes SPIFFE E2E compile check.

Scope decisions from review

Per-request gateway authorization and subject dependency checks are intentional. Published docs remain deferred by maintainer direction; crate and deployment guidance cover this prototype. Replacing the bounded cache, consolidating broader authentication/driver-policy helpers, transparent lineage-rotation retries, generated upstream wire bindings, and promoting the SPIRE fixture into default CI are follow-ups, not changes claimed by this patch.

The shared SPIFFE extraction passed all tracked Cargo lockfile checks, all-target Clippy, nine moved SPIFFE tests, the adapter test, 43 core configuration tests, 100 supervisor token-grant tests, 581 focused server tests, and the live SPIRE fixture. The combined stack also passed 5,139 affected tests (29 skipped), all-target Clippy, and the Kubernetes SPIFFE E2E compile check. Configuration and identity formats are unchanged.