refactor(test-guest): install OpenShell through provisioners

[elezar]

Summary

Refactor test-guest OpenShell provisioning around explicit artifact sources. This lets scenarios establish system state before OpenShell is installed, select a single initial source, and retain staged artifacts for lifecycle actions.

The RPM conformance flow now starts from the candidate RPM and verifies gateway continuity through a single gateway-restart action.

Related Issue

No issue required: localized test-guest lifecycle refactor requested during review of the candidate-installation conformance work.

Rootless Podman lifecycle extraction aligns with #3184.

Changes

• Added candidate-binaries, candidate-RPM, and latest-release-RPM source roles, with shared binary/RPM contracts.
• Stage RPM artifacts and publish source-specific apply scripts so lifecycle actions can install or force-reapply a selected source later.
• Removed the dedicated RPM upgrade and reinstall roles; lifecycle scenarios invoke the source apply scripts instead.
• Consolidated the rootless Podman gateway lifecycle under gateway-podman while retaining rootless service setup.
• Updated the conformance workflow and plan to initialize from the candidate RPM and test only gateway restart continuity.
• Updated the provisioner catalog and test-guest documentation for the source-based lifecycle.

Testing

• mise run pre-commit
• nix run .#test-guest -- --list
• Ansible syntax checks for the source roles
• Local Fedora candidate-RPM conformance run with openshell-candidate-rpm-source and gateway-podman, using the gateway-restart plan

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.