bug(examples): podman token-exchange demo fails to start gateway with documented default image #3297

What happens

Following examples/spiffe-token-exchange-demo/podman/README.md on main, the gateway container exits immediately:

unknown field `compute_driver`, expected one of `name`, `bind_address`,
`health_bind_address`, `metrics_bind_address`, `log_level`,
`compute_drivers`, `credential_drivers`, ...

Why

podman/start-gateway.sh:141 writes the schema v2 scalar:

compute_driver = "podman"

The README's default GATEWAY_IMAGE=ghcr.io/nvidia/openshell/gateway:latest currently resolves to an image built 2026-08-28 (matching the v0.0.116 release), which predates schema v2 and still expects the plural compute_drivers.

Schema v2 landed in 02b664bb ("refactor(config): normalize and enforce gateway schema v2", #2814) on 2026-09-11. So main's demo script and the documented default image are a release apart, and anyone following the README with default settings gets a gateway that will not start.

Note that start-gateway.sh on main still writes the singular form, so this is not a case of the script lagging: the script is correct for main and the default image is stale relative to it.

Reproduce

export OPENSHELL_REPO=/path/to/OpenShell
START_GATEWAY=1 bash "$OPENSHELL_REPO/examples/spiffe-token-exchange-demo/podman/demo.sh"
podman logs openshell-spiffe-demo-gateway

Possible fixes

Any one of these resolves it:

• Pin GATEWAY_IMAGE in the demo to a commit-tagged image matching the checkout. Commit-tagged images do exist (for example ghcr.io/nvidia/openshell/gateway:02b664bb0d978ac0baec9aaa0bf06a2a4f67e83d), and pinning also makes the demo reproducible over time.
• Have start-gateway.sh emit the schema the target image expects.
• Publish a :latest that tracks main, so the README default matches the checkout.

Environment

Verified on macOS 15 (Darwin 25.6.0) with Podman 6.1.1 against a Fedora CoreOS 44 machine VM, but the schema mismatch is platform independent.