fix(e2e): regenerate gateway config via TOML for docker + podman harnesses

The gateway CLI flags moved into TOML config tables in 560550d (#1394),
which made every existing e2e/with-{docker,podman}-gateway.sh invocation
fail with "unexpected argument '--sandbox-namespace'" (and a long tail
of similar driver-specific options) before the gateway could even bind.

Replace the obsolete CLI flags with a synthesized
`[openshell.drivers.<driver>]` table written to `${STATE_DIR}/gateway.toml`
and passed via the new `--config` flag. Only the gateway-wide flags
that survived 560550d (bind-address, port, drivers, db-url, tls-*,
disable-tls, log-level, health-port) stay on the command line.

Both scripts get a small `toml_string` helper to properly TOML-quote
the values (the previous `%q` printf format produced bash-escape, not
TOML-escape). The Docker harness also corrects two field names that
diverged from the driver schema: `docker_network_name` →
`network_name`, and the supervisor binary/image plumbing now reads
through to `supervisor_bin` / `supervisor_image` in the same table.

The Podman harness drops `--ssh-gateway-port` (deleted in 560550d —
gRPC + SSH are multiplexed on the same port now) and substitutes
`network_name` + `gateway_port` for the obsolete `--sandbox-namespace`
(which the Podman driver never had as a typed field).

Author: TaylorMutch

e2e/with-docker-gateway.sh

@@ -448,27 +448,61 @@ else
 fi
 
 echo "Starting openshell-gateway on port ${HOST_PORT} (namespace: ${E2E_NAMESPACE})..."
+
+# Driver-specific options moved from CLI flags into a TOML config table
+# (commit 560550d2). Synthesize a minimal config here and pass --config.
+# Quote a value as a TOML basic string: wrap in double quotes and escape
+# any embedded backslashes / double quotes. Adequate for paths, image
+# refs, and namespace identifiers — none of which contain TOML special
+# characters in practice.
+toml_string() {
+  local value="$1"
+  value="${value//\\/\\\\}"
+  value="${value//\"/\\\"}"
+  printf '"%s"' "${value}"
+}
+
+GATEWAY_CONFIG="${STATE_DIR}/gateway.toml"
+{
+  printf '[openshell]\nversion = 1\n\n'
+  printf '[openshell.gateway]\nlog_level = "info"\n\n'
+  printf '[openshell.drivers.docker]\n'
+  printf 'sandbox_namespace = %s\n'    "$(toml_string "${E2E_NAMESPACE}")"
+  printf 'network_name = %s\n'         "$(toml_string "${DOCKER_NETWORK_NAME}")"
+  printf 'grpc_endpoint = %s\n'        "$(toml_string "${GATEWAY_ENDPOINT}")"
+  printf 'default_image = %s\n'        "$(toml_string "${SANDBOX_IMAGE}")"
+  printf 'image_pull_policy = "IfNotPresent"\n'
+  printf 'guest_tls_ca = %s\n'         "$(toml_string "${PKI_DIR}/ca.crt")"
+  printf 'guest_tls_cert = %s\n'       "$(toml_string "${PKI_DIR}/client.crt")"
+  printf 'guest_tls_key = %s\n'        "$(toml_string "${PKI_DIR}/client.key")"
+  # DOCKER_SUPERVISOR_ARGS holds either ("--docker-supervisor-bin" "<path>")
+  # or ("--docker-supervisor-image" "<image>"); both map to TOML keys on
+  # the docker driver config.
+  for ((i=0; i<${#DOCKER_SUPERVISOR_ARGS[@]}; i+=2)); do
+    case "${DOCKER_SUPERVISOR_ARGS[$i]}" in
+      --docker-supervisor-bin)
+        printf 'supervisor_bin = %s\n'   "$(toml_string "${DOCKER_SUPERVISOR_ARGS[$((i+1))]}")"
+        ;;
+      --docker-supervisor-image)
+        printf 'supervisor_image = %s\n' "$(toml_string "${DOCKER_SUPERVISOR_ARGS[$((i+1))]}")"
+        ;;
+    esac
+  done
+  if [ -n "${GATEWAY_HOST_ALIAS_IP}" ]; then
+    printf 'host_gateway_ip = %s\n'    "$(toml_string "${GATEWAY_HOST_ALIAS_IP}")"
+  fi
+} > "${GATEWAY_CONFIG}"
+
 GATEWAY_ARGS=(
-  --bind-address 0.0.0.0 \
-  --port "${HOST_PORT}" \
-  --drivers docker \
-  --sandbox-namespace "${E2E_NAMESPACE}" \
-  --docker-network-name "${DOCKER_NETWORK_NAME}" \
-  --tls-cert "${PKI_DIR}/server.crt" \
-  --tls-key "${PKI_DIR}/server.key" \
-  --tls-client-ca "${PKI_DIR}/ca.crt" \
-  --db-url "sqlite:${STATE_DIR}/gateway.db?mode=rwc" \
-  --grpc-endpoint "${GATEWAY_ENDPOINT}" \
-  "${DOCKER_SUPERVISOR_ARGS[@]}" \
-  --docker-tls-ca "${PKI_DIR}/ca.crt" \
-  --docker-tls-cert "${PKI_DIR}/client.crt" \
-  --docker-tls-key "${PKI_DIR}/client.key" \
-  --sandbox-image "${SANDBOX_IMAGE}" \
-  --sandbox-image-pull-policy IfNotPresent
+  --config "${GATEWAY_CONFIG}"
+  --bind-address 0.0.0.0
+  --port "${HOST_PORT}"
+  --drivers docker
+  --tls-cert "${PKI_DIR}/server.crt"
+  --tls-key "${PKI_DIR}/server.key"
+  --tls-client-ca "${PKI_DIR}/ca.crt"
+  --db-url "sqlite:${STATE_DIR}/gateway.db?mode=rwc"
 )
-if [ -n "${GATEWAY_HOST_ALIAS_IP}" ]; then
-  GATEWAY_ARGS+=(--host-gateway-ip "${GATEWAY_HOST_ALIAS_IP}")
-fi
 
 e2e_write_gateway_args_file "${GATEWAY_ARGS_FILE}" "${GATEWAY_ARGS[@]}"
 e2e_export_gateway_restart_metadata \

e2e/with-podman-gateway.sh

@@ -326,17 +326,39 @@ export OPENSHELL_E2E_NETWORK_NAME="${PODMAN_NETWORK_NAME}"
 export OPENSHELL_E2E_SANDBOX_NAMESPACE="${E2E_NAMESPACE}"
 
 echo "Starting openshell-gateway on port ${HOST_PORT} (namespace: ${E2E_NAMESPACE})..."
+
+# Driver-specific options moved from CLI flags into a TOML config table
+# (commit 560550d2). Synthesize a minimal config here and pass --config.
+# Quote a value as a TOML basic string: see with-docker-gateway.sh for
+# the same helper (kept duplicated to avoid sourcing across e2e scripts).
+toml_string() {
+  local value="$1"
+  value="${value//\\/\\\\}"
+  value="${value//\"/\\\"}"
+  printf '"%s"' "${value}"
+}
+
+GATEWAY_CONFIG="${STATE_DIR}/gateway.toml"
+{
+  printf '[openshell]\nversion = 1\n\n'
+  printf '[openshell.gateway]\nlog_level = "info"\n\n'
+  printf '[openshell.drivers.podman]\n'
+  # The Podman driver scopes isolation by network rather than namespace.
+  printf 'network_name = %s\n'   "$(toml_string "${PODMAN_NETWORK_NAME}")"
+  printf 'gateway_port = %s\n'   "${HOST_PORT}"
+  printf 'default_image = %s\n'  "$(toml_string "${SANDBOX_IMAGE}")"
+  printf 'image_pull_policy = "missing"\n'
+  printf 'supervisor_image = %s\n' "$(toml_string "${SUPERVISOR_IMAGE}")"
+} > "${GATEWAY_CONFIG}"
+
 GATEWAY_ARGS=(
+  --config "${GATEWAY_CONFIG}"
   --bind-address 0.0.0.0
   --port "${HOST_PORT}"
   --health-port "${HEALTH_PORT}"
-  --ssh-gateway-port "${HOST_PORT}"
   --drivers podman
   --disable-tls
   --db-url "sqlite:${STATE_DIR}/gateway.db?mode=rwc"
-  --sandbox-namespace "${E2E_NAMESPACE}"
-  --sandbox-image "${SANDBOX_IMAGE}"
-  --sandbox-image-pull-policy missing
   --log-level info
 )