feat(podman): honor OCI image working directories - #2563

Summary

Extend the OCI working-directory behavior introduced for Docker in #2530 to the Podman driver. Podman sandboxes can now use the non-root USER and writable WORKDIR already declared by an ordinary OCI image instead of requiring /sandbox as the single blessed workspace.

For a non-default workdir, OpenShell verifies that the final UID, GID, and supplementary groups could already traverse the path and write and enter the directory in the immutable image. Podman then copies the image directory into its persistent workspace volume, and the final supervisor validates the mounted result without creating the path or changing its ownership or mode. An empty workdir, /, or /sandbox retains the existing OpenShell-managed /sandbox compatibility behavior.

Chronology and scope

1. #2509, policy-first OCI image identity, taught Docker and Podman to honor OCI USER when policy does not provide the corresponding identity field. It removed the requirement for custom images to contain a sandbox:sandbox account, but deliberately left workspace handling for follow-up work.
2. #2530, OCI image working directories, added the shared workdir contract and its Docker implementation: use a valid image WORKDIR, verify access as the final identity, grant no new filesystem authority, and preserve /sandbox as the compatibility fallback.
3. This PR adds that same behavior to Podman only. Podman support was separated from feat(sandbox): honor OCI image working directories #2530 because Podman's persistent named volume covers the OCI workdir before the final supervisor starts. Validating the original image therefore requires a small Podman-specific pre-mount probe and identity attestation. Keeping it separate allowed the simpler Docker implementation to merge independently and confines that extra lifecycle machinery to the driver that needs it.

This work was originally developed on top of #2530. Both predecessor PRs have merged, and this PR now targets main.

Related Issue

Part of #2526

Changes

• resolve the immutable image ID, OCI identity, workdir, and image volumes once for both probe and final launch
• validate non-default OCI workdirs in a resource-limited, networkless probe without the workspace volume, secrets, or sandbox token
• derive the probe identity from the effective global-or-sandbox policy, or discover it from the image policy when neither exists
• attest that the final supervisor uses the same normalized UID, GID, and supplementary groups that were probed
• mount Podman persistence at the OCI workdir, allow Podman's initial copy-up, and validate the mounted result without repairing permissions
• retain OpenShell creation and permission preparation only for the explicit /sandbox compatibility fallback
• reject driver-config and image-declared volumes that would mask the workdir or OpenShell control paths
• use attempt-unique probe names and exact-name cleanup without sweeping containers selected by forgeable labels
• bound and sanitize probe diagnostics
• document the shared Docker/Podman no-authority-expansion contract

Why Podman needs a probe

Docker can validate the image workdir inside the final container because OpenShell does not cover that path with a workspace volume. Podman mounts a persistent named volume directly at the OCI workdir, which hides the original image path before the supervisor starts.

The Podman driver therefore creates a minimal one-shot container from the same pinned image ID, without networking, the workspace volume, secrets, or the sandbox token. The probe assumes the final process identity and asks the kernel whether that identity can traverse every parent and write and enter the original workdir. The probe's normalized identity is passed to the final supervisor as an attestation, and the supervisor checks both that the identity still matches and that Podman's copied-up volume remains accessible. OpenShell fails rather than changing permissions if either check fails.

Testing

• mise run pre-commit
• mise run test
• focused supervisor-process, sandbox, Podman driver, and server tests
• Podman OCI identity/workdir E2E against a freshly built supervisor image
• required Branch Checks and Core E2E
• rootless Podman E2E on Ubuntu 26.04

Coverage includes image-policy and global-policy identity selection, supplementary groups, resource limits, cancellation, ambiguous creation, exact probe cleanup, nested volumes, permission preservation after copy-up, and forged validation metadata.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture and user documentation updated
• Required CI is green