fix(core): pin supervisor image tag to gateway version for all drivers

[benoitf]

Summary

Extract the Docker driver's compile-time supervisor image tag resolution into openshell-core so all three compute drivers (Docker, Podman, Kubernetes) pin the supervisor image to the gateway version instead of defaulting to :latest.

Related Issue

Closes #2068

Changes

• Add resolve_supervisor_image_tag() and default_supervisor_image() to openshell-core::config with the same priority chain the Docker driver already used: OPENSHELL_IMAGE_TAG > IMAGE_TAG > CARGO_PKG_VERSION (falls back to dev for 0.0.0)
• Add DEFAULT_SUPERVISOR_IMAGE_REPO constant (repo without tag) to openshell-core
• Deprecate DEFAULT_SUPERVISOR_IMAGE (the :latest constant)
• Update Podman driver to use default_supervisor_image() in config default and make the CLI --supervisor-image arg optional with version-pinned fallback
• Update Kubernetes driver to use default_supervisor_image() in config default and CLI fallback
• Refactor Docker driver to delegate to the shared resolver, removing its local copy
• Update Podman container tests that asserted :latest to use the dynamic default

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[TaylorMutch]

/ok to test cb62ca9

[github-actions]

Label test:e2e applied, but pull-request/2070 is at {"messa while the PR head is cb62ca9. A maintainer needs to comment /ok to test cb62ca9f1715aa52108571d81a17411a07765aeb to refresh the mirror. Once the mirror catches up, re-run Branch E2E Checks from the Actions tab.

[TaylorMutch]

/ok to test aa8af37

[TaylorMutch]

Minor test concern: latest is an acceptable explicit image tag, but default_supervisor_image_is_version_pinned asserts that default_supervisor_image() never ends with :latest. Because that function reads OPENSHELL_IMAGE_TAG/IMAGE_TAG at compile time, OPENSHELL_IMAGE_TAG=latest cargo test -p openshell-core will fail even though the resolver accepts that input.

Please update the test to verify the stable contract instead (the expected repository plus a non-empty tag), and consider adding an explicit resolver case documenting that latest is accepted:

assert_eq!(
    resolve_supervisor_image_tag(Some("latest"), None, "1.2.3"),
    "latest",
);

This is a non-blocking test robustness issue rather than a runtime defect.

[benoitf]

@TaylorMutch PR amended