docs(rfc): clarify workload identity for shared supervisors

[dhirajsb]

Summary

Revise section 5 of NVIDIA#4377 to address the workload-identity review comments. Shared supervisors acquire sandbox-specific JWT-SVIDs on demand, and the gateway independently checks the subject against the authenticated sandbox.

This contribution targets FrostGod's RFC branch. Dedicated-supervisor behavior is unchanged.

Related Issue

Closes NVIDIA#4649. Part of NVIDIA#4311.

Changes

• Bind acquisition, use, and caches to sandbox/run, current ownership, and audience; preserve the supervisor-initiated runtime channel.
• Describe authorized middleware injection through X-Workload-SVID, with destination binding and protection from agent spoofing or disclosure.
• Separate Kata's UDS limitation from supervisor topology. Document a VM-local Teleport bot socket as a provider-specific option to validate, requiring sandbox-scoped authority and isolation from agent processes.
• Preserve fail-closed behavior and private-key confinement; require separate review of delegated acquisition authority.

Testing

• Mermaid validation: all diagrams in the RFC pass.
• git diff --check passes.
• Markdown lint: revised section 5 passes in isolation (heading normalized for standalone lint). Full-file lint reports the same two existing spacing errors at lines 23–24 as the unchanged base.
• Referenced SPIFFE and Teleport documentation reviewed.

Documentation only. No runtime or Kata deployment validation performed.

Checklist

• Conventional Commit title.
• DCO sign-off.
• RFC updated; no implementation or unrelated sections changed.