Summary

Adds the Kubernetes proxy-pod topology on top of the sidecar topology merged in #2076.

proxy-pod moves network enforcement and gateway forwarding into a per-sandbox supervisor Deployment paired 1:1 with the workload pod. The sandbox image runs directly in the workload container; the OpenShell supervisor is not mounted or executed there. This is intentionally a network-only topology and requires Kubernetes NetworkPolicy enforcement.

The product tradeoff is explicit: filesystem/process policy, binary detection, SSH/connect, exec, upload/download, sync, and dynamic provider environment injection are unavailable in this topology. Use combined or sidecar when those capabilities are required.

Related Issue

References #1827, #981, #899, #1305.

Related PRs: #1973, #2074, #2076, #2016.

Changes

• Add the proxy-pod supervisor topology.
• Run network supervision and gateway forwarding in a paired Deployment instead of the sandbox pod.
• Run the sandbox image directly as a non-root workload with all capabilities dropped.
• Inject only standard proxy and CA trust environment into the workload; do not mount gateway credentials or the supervisor binary.
• Create the per-sandbox headless Service, proxy CA Secret, RBAC, owner references, and NetworkPolicies needed for the paired proxy.
• Require NetworkPolicy enforcement to preserve the expected OpenShell network path.
• Add nested proxy_pod.proxy_uid / supervisor.proxyPod.proxyUid configuration.
• Add proxy_pod.affinity / supervisor.proxyPod.affinity with disabled (default), preferred, and required same-node placement modes.
• Add proxy-pod Helm values and Skaffold profile support.
• Document topology choice, architecture, permission model, NetworkPolicy requirements, RuntimeClass status, reduced feature set, and affinity tradeoffs.

Testing

• git diff --check
• cargo test -p openshell-driver-kubernetes --lib (131 passed)
• mise run helm:test (70 passed)
• mise run helm:docs:check
• mise run pre-commit
• Earlier process-supervisor revision: Docker-backed local k3d/k3s L7 allow/deny and live-policy E2E coverage
• Prior validation from feat(kubernetes): add sidecar and proxy-pod topology configurations #2016: proxy-pod topology smoke-tested on Kata Containers and gVisor clusters with NetworkPolicy enforcement enabled

The earlier SSH/exec-driven proxy-pod E2E results predate the direct-workload change. They are retained as evidence for the paired network proxy, but do not validate the intentionally removed process-supervisor session path.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)