sync: upstream catch-up (133 commits, base 2026-05-26) + re-home fork delta after supervisor split

[vessux]

Summary

Upstream-sync rebase: fork delta re-parented onto upstream/main (4848c409 → f23c2c8e, 133 commits absorbed). Per the fork-sync flow this PR is a review artifact, not a merge — it will show CONFLICTING because the rebased branch cannot fast-forward into main. Land via the force-push below.

17 fork-delta commits replayed + 1 adaptation commit. The stale style: cargo fmt commit was dropped (re-formatted in the adaptation pass).

Verification (macOS)

• cargo build/clippy/test --workspace --features openshell-prover/bundled-z3 — green, clippy zero warnings, all tests pass (722/723 + ignored gateway/podman integration tests).
• Proto pre-flight clean: fork fields all in 9000+ (cred_inject=9000, echo=9001, trust_check=9002, volumes=9003, SANDBOX_PHASE_STOPPED=9004); zero upstream collisions in the 8000/9000 range.

Conflict surfaces resolved

• refactor(openshell-sandbox): Split sandbox into process and network subcrates. NVIDIA/OpenShell#1650 openshell-sandbox → supervisor process/network split (biggest): cred-inject + L7 egress + trust stack re-homed into openshell-supervisor-network (git ORT auto-followed most renames). trust.rs (fork-new) relocated to the network crate; secrets.rs tracked to openshell-core; trust_cache wiring moved into network/run.rs. L7EvalContext field-set merged (upstream activity_tx/dynamic_credentials/token_grant_resolver + fork cred_inject/echo/trust_cache/trust_check).
• fix(cli): require explicit gpu sandbox flag NVIDIA/OpenShell#1835 explicit GPU flag (breaking): adopted upstream's gpu bool model; dropped fork's now-removed gpu_device refs (vm-driver validation reduced to the --volume rejection; template checks already exist upstream as validate_vm_template_request).
• refactor(proto): move phase and current_policy_version into status NVIDIA/OpenShell#1565 proto refactor + 9000+ renumber: fork field renumber reconciled to final 9000+ values; Sandbox::phase() accessor used where the field moved into status.
• --volume × upstream container refactor: threaded image_sandbox_user through the now Result-returning build_container_spec_with_token_and_gpu_default.
• feat(server): declare gRPC auth (mode + scope + role) at the handler, enforce at the router NVIDIA/OpenShell#1596 handler-level gRPC auth: Stop/Start RPCs given #[rpc_auth(bearer, sandbox:write, user)]; obsolete inline authz consts dropped (moved to method_authz).
• NVIDIA mirror CI: honored the fork's deletion of e2e-label-help.yml (modify/delete).

Not landing via this PR

Force-push to main is the human step (default-branch protection):

git push origin sync/upstream-2026-06-18:main --force-with-lease

Post-merge: tag vX.Y.0 → release workflow builds binaries → bump OPENSHELL_FORK_TAG in openlock src/sandbox/fork-binaries.ts; smoke-test a fresh gateway on Mac/podman.