feat(server): add bundled docker compute driver

[drew]

Summary

Add a bundled Docker compute driver to the gateway on top of the supervisor-relay base. This lets the gateway provision sandboxes directly through the local Docker daemon without exposing sandbox ports or spawning a separate Docker driver binary.

Related Issue

N/A

Changes

• add docker as a supported compute driver kind
• add an in-process Docker backend in openshell-server using Bollard
• wire Docker CLI and env config for supervisor and TLS bind mounts
• keep Docker sandboxes as long-lived containers with no /sandbox volume
• update architecture and support docs for the Docker backend

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

mise run pre-commit currently fails in python:proto because grpc_tools.protoc is not installed in the local Python environment. Rust formatting and the touched crate test suites passed:

• cargo fmt --all
• cargo test -p openshell-server --lib
• cargo test -p openshell-core --lib

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-888.docs.buildwithfern.com/openshell