fix(supervisor): wire prepare_supervisor_identity_mount_namespace_from_env

[yhattm]

Problem

When a gateway is configured with provider_spiffe_workload_api_socket_path, the Kubernetes driver injects PROVIDER_SPIFFE_WORKLOAD_API_SOCKET into sandbox pods. The supervisor then calls supervisor_identity_mount_from_env() inside spawn_entrypoint() (process.rs:524), which expects SUPERVISOR_IDENTITY_MOUNT_NS to be initialised by prepare_supervisor_identity_mount_namespace_from_env().

Without this call the OnceLock is never populated, causing every sandbox pod to crash with:

Error: Failed to prepare supervisor identity isolation: supervisor identity
mount namespace was not prepared before startup hardening

This makes the provider_spiffe_workload_api_socket_path gateway config option completely unusable — any cluster that enables it will have all sandbox pods crash-loop.

Root Cause

prepare_supervisor_identity_mount_namespace_from_env() is defined in process.rs but was never wired into the startup sequence. The function creates a private mount namespace to hide the SPIFFE Workload API socket from the child process (security isolation). It must run before supervisor_identity_mount_from_env() is called.

Fix

Call prepare_supervisor_identity_mount_namespace_from_env() in run_process() immediately after prepare_filesystem(), before any child processes are spawned.

Testing

Verified against an EKS cluster with SPIRE deployed:

1. Set provider_spiffe_workload_api_socket_path = "/run/spire/certs/spire-agent.sock" in gateway config
2. Before fix: sandbox pod crashes on every start with the error above
3. After fix: sandbox pod starts cleanly, /run/spire/certs/spire-agent.sock is accessible inside the container

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @yhattm.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}