refactor(compute): support external driver parity

[drew]

Summary

Make external compute drivers follow the same public gRPC boundary as in-tree drivers. Canonical driver names can be supplied over UDS, driver-requested callback listeners are validated generically, and omitted process identity remains omitted so every runtime can apply its native defaults.

Related Issue

Part of #2417

Stacked on #2743.

Changes

• preserve omitted process user and group fields by default for every compute driver
• avoid adding capability messages, feature enums, or configuration for process identity behavior
• structurally validate driver-requested callback listeners independently of driver name
• allow canonical built-in names with --compute-driver-socket, with the explicit endpoint taking precedence
• route shutdown, startup, lifecycle, and policy operations through the public compute-driver RPC boundary
• add fake external UDS coverage using a canonical driver name
• document the supported extension boundary in architecture notes and agent diagnostics; no public docs/ changes are included

Testing

• mise run pre-commit
• focused shutdown/startup reconciliation tests
• process-identity create/get and policy-backfill tests
• external UDS lifecycle tests

Checklist

• Changes are scoped to the accepted issue
• Tests cover the external UDS path
• Architecture notes and agent diagnostics are updated
• Public-facing documentation changes remain in refactor(compute): unify gateway restart reconciliation #2743, not this follow-up

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2744.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for e174352. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[drew]

/ok to test 46b9a23

[elezar]

Non-blocking review suggestions for clarity and maintainability. These are not approval-blocking concerns.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[elezar]

/ok-to-test f067e60

[drew]

/ok to test

[elezar]

/ok-to-test f067e60

[elezar]

/ok-to-test f067e60

[elezar]

/ok-to-test f067e60

[elezar]

@drew A quick summary of the small review changes I folded into this PR before restoring the branch to f067e60:

• Updated the external-driver documentation to state that a socket endpoint replaces normal construction for the selected name, including canonical built-in names, and added both custom-name and Docker examples.
• Corrected the compute-driver protocol compatibility comment from unknown feature values to unknown fields, matching protobuf forward-compatibility semantics after feature negotiation was removed.
• Updated the debug-openshell-cluster guidance to use the final gateway_manages_lifecycle capability name.

These were documentation and contract-clarity changes only; they did not add another behavior change to the PR.

[elezar]

Reviewed and addressed issues as called out in the comment.

LGTM, but feel free to get a second opinion.

[elezar]

/ok-to-test 48c9287