refactor(server): extract kubernetes compute driver

[drew]

Summary

Extract the Kubernetes sandbox implementation out of openshell-server into a dedicated compute-driver crate and introduce shared sandbox protobufs for gateway and driver internals.

Related Issue

Linear: https://linear.app/nvidia/issue/OS-51/extract-kubernetes-compute-driver-from-openshell-server
Parent: https://linear.app/nvidia/issue/OS-8/openshell-drivers

Changes

• moved shared sandbox lifecycle types into proto/sandbox.proto and added internal compute driver RPCs in proto/compute_driver.proto
• added the new openshell-driver-kubernetes crate with the extracted Kubernetes driver library and tonic service binary
• replaced direct Kubernetes coupling in openshell-server with a gateway-owned compute runtime and routed sandbox creation, deletion, watch handling, and endpoint resolution through it
• updated the gateway architecture doc to describe the new compute-driver boundary

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Additional verification:

• cargo test -p openshell-driver-kubernetes --lib
• cargo test -p openshell-server --lib
• mise run pre-commit is currently blocked locally by an untracked tmp/Dockerfile.large-test file missing an SPDX header

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.