feat(sandbox): add canonical main process

[drew]

Summary

Add one canonical main process to every sandbox and make it the process observed by sandbox connect. The supervisor retains and multiplexes its session across reconnects, while sandbox exec remains an independent process path. Any unexpected canonical-process exit, including exit code 0, is persisted on the sandbox and transitions it to Error; intentional stop/start teardown is exempt.

Related Issue

Closes #2710

Changes

• Add command and tty directly to the public and compute-driver sandbox specs, with sandbox-owned main instance and exit status.
• Normalize omitted and pre-upgrade persisted driver specs to the default /bin/bash -l TTY main process.
• Launch the canonical process in Docker, Podman, Kubernetes, and VM runtimes with exact argv transport and native runtime restart disabled.
• Add a supervisor-owned PTY/pipe session multiplexer with bounded replay, live fanout, one stdin owner, read-only readers, resize, signals, and disconnect-safe process ownership.
• Route sandbox connect through the retained main session while preserving independent exec, SFTP, editor, and forwarding behavior.
• Make trailing sandbox create argv the persisted main process, attach interactively by default, and add --detach.
• Record unexpected main-process exits as terminal sandbox errors and preserve intentional stop/start lifecycle transitions.
• Update SDKs, architecture and published docs, driver references, CLI agent guidance, and E2E coverage.

Testing

• mise run pre-commit
• mise run test with an isolated system-gateway directory
• Focused core, server, supervisor, VM driver, SDK, and CLI lifecycle tests
• Docker sandbox lifecycle E2E, including competing attachments, disconnect/reconnect, same PID, PTY history replay, exit status, and --no-keep
• Pre-upgrade VM driver-spec compatibility regression coverage

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• User-facing and architecture documentation updated
• Related agent skill updated

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2726.docs.buildwithfern.com/openshell