fix(ci): restore default e2e coverage with a Kubernetes recovery waiver

[elezar]

Summary

Restore the default Rust E2E coverage when CI exports an empty feature override, and use e2e-conformance-only for intentional conformance-only runs. Temporarily exclude only canonical_main_connect_recovers_its_ssh_transport in the Kubernetes nextest profile while #4445 investigates input-owner cleanup after reconnect. Keep the existing Kubernetes port-forward transport and the test's coverage on other drivers.

The empty-feature behavior underlying this CI coverage gap was introduced by #2925, merged on September 1, 2026. That PR changed the runners from ${VAR:-default} to ${VAR-default} and made an empty feature list skip Rust E2E tests after conformance. #2260, merged on September 7, then wired the Kubernetes workflow's empty default feature input into that override. Together, these changes caused the default Kubernetes lane to run conformance only while reporting success.

Related Issue

No separate implementation issue is required for this localized CI fix, which does not change product behavior or public APIs. The missed coverage is visible in this Kubernetes job.

Temporary Kubernetes-only test waiver: #4445. This PR does not close the investigation.

Changes

• Treat unset and empty feature overrides as driver defaults. Support e2e-conformance-only in the Docker, Podman, Kubernetes, and VM runners and consume it before invoking Cargo.
• Migrate the intentional Docker, Podman, and Kubernetes external-driver conformance-only tasks to the explicit selector. Keep the VM external-driver task running conformance and Rust tests.
• Add an exact-name default-filter exclusion for the one recovery test in profile.e2e-kubernetes. Keep the other 96 restored default Kubernetes tests enabled, along with recovery coverage on other driver profiles.
• Document the selector and the temporary waiver in TESTING.md; update workflow input help. No kind configuration, Service type, or gateway transport changes are included.

Testing

• mise run pre-commit on the final branch.
• Nextest list validation against an isolated fixture confirms the exact recovery name is excluded only in e2e-kubernetes; a similarly named neighbor and an ordinary lifecycle test remain selected. The recovery name is selected under both ci and default profiles.
• Mocked selector dispatch for all four drivers covers unset, empty, conformance-only, default, custom features, and conformance failure propagation. VM checks exercise dispatch after provisioning.
• Shell syntax, task selector parsing, and git diff --check.
• Final GitHub Kubernetes run pending: expected default selection is 96 tests, with the recovery test recorded as skipped.
• Full local mise run ci: the earlier attempt with fresh Go caches hit Rust test linking because system Z3 is unavailable (ld: library 'z3' not found).

Checklist

• Follows Conventional Commits.
• Commits are signed off for DCO.
• Testing documentation updated.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4424.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 63699cd. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.