fix(podman): serialize restart and workload containment

[elezar]

Summary

Prevent Podman watcher and admission reconciliation from stopping a newly restarted workload while its companion supervisor is still exited. Lifecycle mutations and destructive reconciliation now share a per-sandbox gate and re-read runtime ownership/state before containment.

Related Issue

Refs #4115 (staged cross-driver standardization; remains open). This PR implements the focused Podman fix authorized directly by the maintainer.

Changes

• Hold the instance-local gate across create/start/stop/delete, inline rollback, supervisor-loss containment, and admission containment; share it across driver clones.
• Revalidate concrete workload identity, sandbox ownership, role, and current state after acquiring the gate. Preserve genuine supervisor-loss containment and delayed-exit filtering.
• Add barrier-based restart/reconciliation, cancellation/failure/retry, delayed-event, admission, and lock-lifetime regression tests; enable concurrent HTTP fixture requests.
• Document the behavior and limits: independent processes/external Podman commands and accepted remote mutations after cancellation are outside the local guarantee.

Testing

• mise run pre-commit passes, including workspace Clippy, formatting, license and repository lint checks; commit hook passed again.
• cargo test -p openshell-driver-podman: 235 tests pass on current main plus this fix.
• Controlled live restart/watch qualification in tmachine; Ready and exec verified with the gate, genuine-loss containment retained.
• Full mise run ci: attempted; host Z3/ext4-tool prerequisites were supplied from existing Nix packages, then the workspace build exhausted host disk while linking SDK/server tests. Full local CI remains unqualified.
• Standard mise run e2e:podman: entrypoint attempted; host has no Podman CLI. The tmachine comparison above supplies focused live coverage.

Controlled live comparison on Fedora 44 tmachine, rootless Podman 5.8.1, SELinux Enforcing: a temporary three-second pause between workload and supervisor start failed with ContainerExited when the start gate was bypassed; the same pause with the gate reached Ready and exec printed live-gate-pass. Subsequent genuine supervisor loss still contained the workload. The probe used temporary instrumentation on otherwise current code; instrumentation was removed. Gateway recovery after this forced loss was rejected by phase preconditions and is not claimed here.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Crate/runtime documentation and the related debugging skill updated

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4117.docs.buildwithfern.com/openshell