feat(vm): add standalone libkrun compute driver

[drew]

Summary

Add a standalone openshell-driver-vm crate that owns the libkrun-based VM runtime and wire openshell-server to talk to it over the internal ComputeDriver gRPC contract via a Unix domain socket (per rfc-0001).
This keeps VM runtime assets and loader dependencies out of the gateway binary while preserving the existing sandbox create/exec flow.
This PR is marked draft because follow-up fixes are still needed for VM TLS credential wiring, driver-owned environment precedence, and startup validation of embedded VM assets.

Related Issue

None.

Changes

• Added the new openshell-driver-vm crate with embedded runtime assets, libkrun/gvproxy launch code, rootfs preparation, and a hidden helper mode for entering the VM runtime.
• Updated openshell-server to spawn the VM compute driver as a sibling process, connect to it over gRPC on a Unix domain socket, and drop the direct Cargo dependency on the VM runtime crate.
• Added VM driver config/plumbing updates in openshell-core, openshell-server, local start scripts, and architecture docs.
• Added/updated tests and local verification for the standalone VM driver path, including server-side sandbox creation through the spawned driver.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Additional verification:

• cargo check -p openshell-server
• cargo test -p openshell-server
• RUSTC_WRAPPER= OPENSHELL_VM_RUNTIME_COMPRESSED_DIR=/Users/anewberry/dev/openshell-d/target/vm-runtime-compressed cargo test -p openshell-driver-vm
• RUSTC_WRAPPER= OPENSHELL_SERVER_PORT=18080 make start
• target/debug/openshell sandbox create --gateway-endpoint http://127.0.0.1:18080 --no-bootstrap -- echo hi

Current known failure:

• mise run pre-commit still fails in openshell-cli/src/run.rs because SandboxStatus no longer has driver_name / driver_config fields.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.