test(podman): run namespace stories against a shared gateway

[elezar]

Summary

Run each Podman user-namespace profile as a named Rust test against the tmachine guest’s shared gateway. Each scenario owns sandbox cleanup, exact gateway configuration restoration, and readiness checks, including after assertion failures.

Final unit of the draft stack, based on #4538 (codex/4119-suite-layout). This PR preserves the existing shared-gateway implementation for separate review.

Related Issue

Follow-up to #4119. Part of #3954.

Changes

• Replace the Ansible profile sequence and TOML fixtures with default, auto, keep_id, and private Rust story modules.
• Compare OpenShell UID mappings with direct Podman in the gateway service user’s context and check managed workspace ownership and write access.
• Serialize scenarios with nextest and a guest-side lock covering setup, assertions, cleanup, and restoration.
• Wait for sandbox deletion, restore the exact original gateway configuration, and verify health and sandbox absence. Retain a dirty marker after interruption or failed restoration.
• Keep Ansible responsible for guest preparation, archive installation, registration, one nextest invocation, and failure diagnostics.
• Add pure assertions, an opt-in deliberate-panic recovery scenario, source checks, and fixture documentation.

Testing

• mise run pre-commit passed for this signed-off commit.
• Both pure Podman assertions passed; the test target compiled.
• The tree is identical to the former test(podman): run namespace stories against a shared gateway #4464 head 208144912, which passed the full configured unit suite on 2026-10-13.
• Earlier ARM64 Fedora 44 tmachine validation passed four live profiles and two pure assertions in each rootful/rootless lane. Rootless deliberate-panic recovery restored the gateway and passed a subsequent default-profile test.

Live validation was on 2026-10-07 using QEMU/HVF on ARM64 macOS, runtime artifacts from Actions run 37483726385 at b10ab39f9, and the shared-gateway test archive. Live tests have not been repeated after subsequent main rebases. The fixture requires a disposable tmachine guest, systemd, passwordless sudo, and a dedicated Podman gateway; image preparation and fixture reuse remain follow-ups.

The combined stack at 7e72adc6c passed nix develop --command mise run --jobs 1 ci on 2026-10-14. This covers the configured repository lint, compile/type checks, and unit suites; live gateway/tmachine execution was not repeated during this split.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant suite and testing guidance updated.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4464.docs.buildwithfern.com/openshell