feat(cli): harden Docker and Podman doctor probes

[kvnloo]

Summary

Implements the scoped NVIDIA#3694 runtime-doctor design on a fresh branch based on NVIDIA/OpenShell main at b8ffe5244cb244a1d74a4a03d69afe3da07e5f08.

Closes #5. Long-term shared discovery/diagnostic architecture is tracked separately in #6.

Behavior

• openshell doctor check: probes installed Docker and Podman candidates concurrently; succeeds when at least one is ready.
• openshell doctor check --driver docker|podman: selected runtime is authoritative.
• Docker retains the existing docker info --format {{.ServerVersion}} readiness check.
• Podman is checked as an API service:
  • explicit OPENSHELL_PODMAN_SOCKET -> podman --url unix://... version --format {{.Server.Version}}
  • no override -> podman --remote version --format {{.Server.Version}}
• Empty OPENSHELL_PODMAN_SOCKET is rejected explicitly.
• Each subprocess has a five-second deadline.
• Default Docker/Podman probes run concurrently.

Tests

Deterministic fake-runtime coverage includes:

• Docker-only and Podman-only hosts
• neither installed / both unhealthy / both healthy
• mixed runtime health
• authoritative --driver
• empty Podman socket
• Podman remote-service invocation
• exact OpenShell socket -> --url
• timeout and concurrent wall-clock behavior

Also adds a real e2e-podman doctor test against the harness-exported OPENSHELL_PODMAN_SOCKET.

GitHub Actions validation

The fork inherits NVIDIA workflows that depend on NVIDIA self-hosted runner labels, so those jobs cannot provide a complete fork-side signal. A validation-only pull-request/4 mirror runs the relevant checks on GitHub-hosted ubuntu-latest without adding CI-only files to this PR.

Current validation includes:

• cargo fmt --all -- --check
• cargo check -p openshell-cli
• cargo build -p openshell-cli
• deterministic docker_preflight doctor matrix
• real Docker doctor probe
• real Podman API service + doctor probe

Validation run: https://github.com/kvnloo/OpenShell/actions/runs/36690027304

References

• feat(cli): support Podman in openshell doctor check NVIDIA/OpenShell#3694
• feat(cli): support Podman in doctor check NVIDIA/OpenShell#3748
• test(podman): close CI coverage gaps in Podman compute driver testing NVIDIA/OpenShell#3663
• feat(gateway): explain compute driver discovery decisions NVIDIA/OpenShell#3211
• prior downstream experiment: feat(cli): support Podman in doctor check #1

Draft until the full validation lane is green and the final architecture audit is complete.

[github-actions]

Label test:e2e applied for 7ff6ed3. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.