feat(cli): harden Docker and Podman doctor probes

[kvnloo]

Summary

Implements the scoped NVIDIA#3694 runtime-doctor design on a fresh branch based on NVIDIA/OpenShell main at b8ffe5244cb244a1d74a4a03d69afe3da07e5f08.

Closes #5. Long-term shared discovery/diagnostic architecture is tracked separately in #6.

Behavior

• openshell doctor check: probes installed Docker and Podman candidates concurrently; succeeds when at least one is ready.
• openshell doctor check --driver docker|podman: selected runtime is authoritative.
• Docker retains the existing docker info --format {{.ServerVersion}} readiness check.
• Podman is checked as an API service:
  • explicit OPENSHELL_PODMAN_SOCKET -> podman --url unix://... version --format {{.Server.Version}}
  • no override -> podman --remote version --format {{.Server.Version}}
• Empty OPENSHELL_PODMAN_SOCKET is rejected explicitly.
• Each subprocess has a five-second deadline.
• Default Docker/Podman probes run concurrently.

Tests

Deterministic fake-runtime coverage includes:

• Docker-only and Podman-only hosts
• neither installed / both unhealthy / both healthy
• mixed runtime health
• authoritative --driver
• empty Podman socket
• Podman remote-service invocation
• exact OpenShell socket -> --url
• timeout and concurrent wall-clock behavior

Also adds a real e2e-podman doctor test against the harness-exported OPENSHELL_PODMAN_SOCKET.

GitHub Actions validation

The fork inherits NVIDIA workflows that depend on NVIDIA self-hosted runner labels, so those jobs cannot provide a complete fork-side signal. A validation-only pull-request/4 mirror runs the relevant checks on GitHub-hosted ubuntu-latest without adding CI-only files to this PR.

Current validation includes:

• cargo fmt --all -- --check
• cargo check -p openshell-cli
• cargo build -p openshell-cli
• deterministic docker_preflight doctor matrix
• real Docker doctor probe
• real Podman API service + doctor probe

Validation run: https://github.com/kvnloo/OpenShell/actions/runs/36690027304

References

• feat(cli): support Podman in openshell doctor check NVIDIA/OpenShell#3694
• feat(cli): support Podman in doctor check NVIDIA/OpenShell#3748
• test(podman): close CI coverage gaps in Podman compute driver testing NVIDIA/OpenShell#3663
• feat(gateway): explain compute driver discovery decisions NVIDIA/OpenShell#3211
• prior downstream experiment: feat(cli): support Podman in doctor check #1

Draft until the full validation lane is green and the final architecture audit is complete.

October 18 exact-head Clippy remediation

• On existing PR branch feat/3694-runtime-probe-hardening, ee45fa8d fixes the exact clippy::doc_markdown finding: backticks around OpenShell in socket discovery Rustdoc. The changed source blob 7c4fa2d0 was read back from GitHub; only that one-line source change was introduced by this commit.
• Previous fork validation at validation head ae6571f: Clippy affected crates FAILED, CLI/unit/doctor matrix SKIPPED; real Podman service probe PASSED. This is historical, not fresh evidence for the repaired head.
• Existing CI-only pull-request/4 branch advanced non-force to baeb4ea0, merging the corrected source while preserving .github/workflows/fork-doctor-validation.yml unchanged. API returned no new run for that head; hosted Clippy/CLI/E2E remain NOT RUN, not green. The execution container has no Cargo toolchain.
• Requirement review: origin #3694 expects the configured/detected compute driver to be diagnosed; this PR's default any healthy runtime fallback can pass healthy Docker with a broken configured Podman. This must be resolved or explicitly agreed before origin publication. Draft origin #3970 is a separate Docker doctor-provider redesign (author: elezar); coordinate rather than duplicate.

Status: CHECK / CI + requirement gap. No upstream publication or merge authorization asserted; DCO/vouch, required CI, and maintainer adoption remain separate gates.

[github-actions]

Label test:e2e applied for 7ff6ed3. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.