feat(runtime): add durable Podman bootstrap authority

[ericksoa]

Summary

Add the inert authority primitives needed to bootstrap an OpenShell-compatible Podman workload without racing the existing OpenShell watcher. This slice discovers one held workload and durably owns watcher suspension; it does not activate Podman, replace a workload, or advertise runtime support.

Related Issue

Part of #7744.

Changes

• Add an atomic, durable watcher lease bound to the OpenShell watcher process identity, including PID-reuse detection and compare-and-swap updates.
• Add bounded double inspection of one held Podman workload, with immutable identity and ownership-label validation before it can become bootstrap source material.
• Require the observed OpenShell namespace label to match the namespace supplied by the caller; empty or cross-namespace ownership evidence fails closed.
• Reserve bootstrap command scope on the injected ContainerEngine boundary without introducing Podman switches in central orchestration.
• Record the ownership and sequencing contract in src/lib/onboard/lifecycle-contracts.md.
• Cover identity, concurrent lease acquisition, stale ownership, malformed inspection output, bounded fields, cleanup behavior, empty namespaces, and namespace mismatches.
• Keep the provider dormant: no production registration, cutover, image bootstrap, GPU or local inference, recovery activation, installer change, or OpenShell repository change is included.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The change strengthens an internal ownership check on a dormant, unsupported Podman path. It adds no command, option, supported workflow, default, or recovery step.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Nine-category security review approved the current branch revision with no blocking findings.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The writer reviewed the implementation, negative tests, production call sites, and current platform-support and troubleshooting docs. This remains an internal fail-closed check on an unsupported path; adding public docs would imply support the repository does not claim.
• Agent: Codex Desktop documentation writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable; the dormant Podman ownership helper does not change DGX Station behavior.
• Station profile/scenario: Not applicable.
• Result: Not applicable.
• Supporting evidence: Not applicable.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing the target branch when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 13 focused held-workload tests pass, including empty-input and cross-namespace rejection; npm run build:cli, npm run typecheck:cli, and git diff --check pass.
• Applicable broad gate passed — current repository CI is running and remains authoritative.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — not applicable; no user-facing docs changed.
• Doc pages follow the style guide (doc changes only) — not applicable.
• New doc pages include SPDX header and frontmatter (new pages only) — not applicable.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[apurvvkumaria]

Security review: approved

Reviewed the current branch revision across the repository’s nine security categories.

• Trust and authorization: the observed OpenShell namespace must now match the caller-provided namespace before the workload can be treated as owned.
• Input validation: empty, malformed, oversized, and mismatched ownership values fail closed.
• Injection and command execution: no command construction or execution boundary changed.
• Secrets and sensitive output: no credential handling or diagnostic output changed.
• Concurrency and lifecycle safety: the existing double-inspection and immutable runtime identity checks remain intact.
• Error handling: namespace failures stop before mutation and use the existing bounded ownership diagnostic.
• Dependency and supply chain: no dependency or lockfile change.
• Regression coverage: 13 focused tests pass, including empty-input and cross-namespace rejection; CLI build and typecheck pass.
• Documentation: an independent writer confirmed no user-facing docs are needed because this path remains internal and unsupported.

No blocking findings remain.

[cv]

Reviewed commit 14d8f522f as the root of the runtime stack. The PR description defines a dormant watcher-lease and held-workload authority slice, but the effective diff contains about 100 files and 13,000 additions across managed images, bootstrap adapters, snapshots, clone restore, Hermes brokering, messaging, inference, and other runtime work. That effective scope does not match the approved slice or its recorded tests and documentation review. The branch also conflicts with current main, and image, audit, CI, and E2E checks fail.

Reconstruct this root from current main with only the container-engine boundary, Podman adapter/socket authority, held-workload inspection, watcher lease, lifecycle contract, and directly protecting tests required by this slice. Do not carry descendant runtime, snapshot, broker, image-publication, or messaging changes into the root. Because the root must change before descendants can be reviewed reliably, the remaining stack stays blocked until this reconstruction passes its gates.