bug: openshell.spec %build does not compile from source

[politerealism]

Part of: #3511

User Story

As someone building OpenShell via rpmbuild/mock (Fedora's build path), I want %build to actually invoke cargo build, so the package can build in a network-isolated Fedora build environment.

Problem Statement

openshell.spec's %build section only runs test -x "${OPENSHELL_PREBUILT_BINARIES_DIR}/openshell" (and the same for openshell-gateway/openshell-prover), then %install copies binaries from that externally-populated directory. No compilation happens inside the RPM build itself.

Impact / Why This Matters

This is disqualifying for Fedora submission — Koji requires packages to build from source inside the sandboxed, network-isolated build root. The current workaround (populating OPENSHELL_PREBUILT_BINARIES_DIR from an external CI step) works for OpenShell's own release pipeline but has no equivalent in Fedora's infrastructure, so there is no way to work around this short of fixing the spec itself.

Acceptance Criteria

• %build calls cargo build --release --offline --locked for openshell, openshell-gateway, and openshell-prover, using the vendored crate sources set up by %cargo_prep
• Build succeeds in a mock chroot with networking disabled
• No dependency on OPENSHELL_PREBUILT_BINARIES_DIR or any other externally-populated path remains in the spec

Reproduction Steps

1. rpmbuild -bb openshell.spec (or build the SRPM in mock) without pre-populating OPENSHELL_PREBUILT_BINARIES_DIR.
2. %build's test -x assertions fail immediately since nothing built the binaries.

Environment

• Any Fedora/RHEL mock chroot
• Koji build environment (no network access after %prep, no ability to inject external artifacts)

[politerealism]

Consolidating this into the parent tracking issue #3509 as a listed work item rather than keeping it as a separate issue. Closing this one — see #3509 for the current text.