feat(docker): support corporate proxy CA bundles

[feloy]

🏗️ build-from-issue-agent

Summary

Add explicit custom CA bundle support for Docker compute-driver corporate forward proxies. The gateway validates and stages the operator-owned bundle into the supervisor archive at a fixed internal path without exposing the host path to sandbox workloads.

Related Issue

Closes #3545

Changes

• Add and validate the Docker proxy_ca_bundle configuration.
• Revalidate and package the CA bundle for each supervisor archive with fixed ownership, permissions, and argv.
• Render OPENSHELL_SANDBOX_PROXY_CA_BUNDLE in the Docker gateway task.
• Add unit coverage and a Docker corporate-proxy E2E suite covering CONNECT authentication, policy enforcement, HTTPS proxy trust, TLS interception, workload trust, and fail-closed configuration.
• Document the Docker trust contract in driver, reference, architecture, and debugging documentation.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• cargo test -p openshell-driver-docker — 125 passed
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker --test docker_corporate_proxy --no-run
• bash -n tasks/scripts/gateway-docker.sh
• OPENSHELL_E2E_DOCKER_TEST=docker_corporate_proxy mise run e2e:docker — not run locally because the Docker CLI/daemon is unavailable. Podman is installed, but aliasing it as Docker would not validate the Docker runtime/socket semantics exercised by this path.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.