test(e2e): add VM-backed E2E suite runner

[drew]

Summary

Add a local E2E runner that can build OpenShell from the current checkout, launch the gateway in a disposable QEMU VM provided by #2471, and execute a named host-side suite against a consistent loopback endpoint. The same entry point also supports running the gateway directly on the host.

Stack

Child of #2471, which provides the base QEMU VM infrastructure.

Related Issue

N/A — internal E2E infrastructure slice.

Changes

• Add repeatable loopback-only QEMU port forwarding with validation before VM realization
• Add e2e/run.sh with explicit host and VM modes, native and cross builds, portable supervisor staging, isolated gateway metadata, lifecycle management, and readiness checks
• Add the initial portable Docker gateway configuration and driver-neutral smoke suite
• Add the independent mise run e2e:run -- ... passthrough task
• Document mode selection, build targets and prerequisites, configuration and suite extension points, forwarding, and retained state

Testing

• mise run pre-commit passes
• Unit tests added/updated (not applicable; production Rust behavior is unchanged)
• E2E tests added/updated (host and Ubuntu/Docker VM smoke both pass)
• bash -n nix/vm/run.sh e2e/run.sh e2e/suites/smoke.sh
• shellcheck nix/vm/run.sh e2e/run.sh e2e/suites/smoke.sh
• nix fmt
• git diff --check
• Argument, suite, catalog, and port-forward validation cases
• Host/VM suite contract, exact suite exit status, cleanup, retained state, and byte-identical guest configuration checks

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• VM developer workflow documentation updated
• Parent PR is linked

Podman VM coverage

• Add VM-only guest setup hooks for checkout-specific preparation before gateway startup
• Build the checkout supervisor image in the Ubuntu guest through the rootless Podman API service
• Relay the rootless netavark bridge to the VM-host gateway for supervisor callbacks
• Add a reusable Podman sandbox shutdown suite with opt-in transport-close classification assertions for stacked changes

Validated with the Ubuntu ARM64 Nix VM, rootless Podman 4.9.3, and a real sandbox create/delete lifecycle.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.