test(openshell): verify drivers and promote supported environments #580

Outcome

Establish the acceptance evidence and documentation required to promote only verified OpenShell environments.

Scope

• Add the common OpenShell live verifier for gateway readiness, lifecycle, workspace mount, clone mount, kit/agent behavior, provider/policy behavior, ports, and cleanup.
• Capture structured verification transcripts without exposing credentials.
• Add local-driver support matrix and runbook documentation after evidence passes.
• Add MXC and Kubernetes driver-specific acceptance harnesses in isolated non-production environments.
• Validate MXC tenancy/project isolation and cleanup.
• Validate Kubernetes namespace isolation, least-privilege workload identity, NetworkPolicy, PVC/workspace behavior, service exposure, RBAC, cleanup, and audit correlation.
• Keep OpenShell explicit-selection-only unless a later ADR approves a default/auto-detection change.

Promotion criteria

Each advertised driver/platform has a passing live transcript, no orphaned verifier resources, security review of mounts/providers/policy/cleanup, and matching documentation. MXC and Kubernetes remain planned until their dedicated checks pass.