epic(acq): add OpenShell backend #573

Goal

Deliver NVIDIA OpenShell as an explicitly selected, experimental acq backend. OpenShell provides the policy-enforced abstraction needed to extend acq beyond today's local backends toward Microsoft Execution Containers (MXC) and Kubernetes, without advertising a compute driver until it has passed its own live acceptance suite.

Operating Constraints

• Preserve the generic devenv-enabled base-image direction, neutral --image / ACQ_IMAGE, kit-installed agents, provider-kit facts, host-authoritative configuration, and existing --clone contract.
• Keep acq as the host-side secret authority. OpenShell receives provider/profile bindings and placeholders, never credential values in guest files, command arguments, logs, provenance, or generated policy.
• Use default-deny policy generated from neutral kit/provider allowlists, with the qualified agent executable ancestry as the normal process boundary.
• Use an explicitly approved host bind mount for the selected workspace. --clone mounts the existing disposable host scratch clone; upload/download is an explicit fallback only.
• Start explicit-selection-only. Do not alter current backend auto-detection until a later reviewed decision.

Delivery Structure

This epic is decomposed into native GitHub sub-issues. Their dependency metadata is authoritative for sequencing; implementation PRs will use base-branch stacks where a reviewable chain is beneficial and separate branches/workspaces where work is independent.

The initial support claim is a locally managed OpenShell gateway and only the compute drivers that pass the live verifier. MXC and Kubernetes are planned acceptance targets, not implied support claims.

Existing Baseline

Build from current Quickstart main, which includes the neutral image override, centralized agent catalog, kit-installed agents/provider facts, host-authoritative configuration direction, and lifecycle environment propagation.

Do not stack this work on the independent MSB snapshot/restore PR.

Completion Criteria

• Each delivered capability has offline command-shape/translation coverage and a documented support boundary.
• The local OpenShell verifier demonstrates lifecycle, workspace, kit, provider/policy, port, and cleanup behavior without exposing secrets.
• MXC and Kubernetes are documented only after their dedicated driver-specific verification passes.
• All implementation PRs pass required checks and human review before merge.