fix(gateway)!: handle delayed Podman bridge listeners

[elezar]

Summary

Fix rootful Podman gateway startup when Podman has allocated a managed bridge gateway address but netavark has not assigned that address yet. The gateway uses delayed exact binding where Linux supports it and a narrowly scoped fallback for the nested Fedora canary topology.

This PR is the third change in the #3181 → #3165 → #2874 stack. It also builds on the reusable rootful Podman test-guest configuration merged in #3184.

Related Issue

No issue required: this is a focused fix for a reliably failing Fedora release-canary regression. Longer-term driver-owned callback relay work remains tracked in #2540.

Release Canary reference: https://github.com/NVIDIA/OpenShell/actions/runs/32448768823/job/96673135310

Changes

• Replace the scalar exact_bind_address listener selector with a structured GatewayExactBindAddressRequirement, allowing trusted built-in drivers to identify addresses eligible for delayed binding.
• Allow only the built-in rootful Podman driver, using its automatically discovered managed-bridge address, to request delayed binding.
• Use Linux IP_FREEBIND when the bridge gateway address has not yet been assigned.
• When delayed exact binding is unavailable in the nested Linux container topology, use an IPv4 wildcard socket with primary scope only for loopback destinations and callback-only scope elsewhere.
• Document the listener behavior and Podman networking constraints.
• Run Fedora conformance against candidate RPMs in rootless and rootful Podman modes with sandbox lifecycle and gateway-restart continuity coverage.

Security impact

The nested-container fallback exposes only the sandbox-callable gRPC surface on non-loopback IPv4 destinations in the outer container namespace. User, administrator, health, reflection, non-callback inference, and HTTP routes remain unavailable there. Sandbox authentication and the surrounding container-network boundary remain required defenses.

Testing

• mise run pre-commit
• Focused Docker and Podman gateway-listener tests
• git diff --check origin/codex/sandbox-lifecycle-conformance..HEAD
• Fedora rootless and rootful conformance lanes (GitHub Actions)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/2874 does not exist yet. A maintainer needs to comment /ok to test e2e39b416207323bc6ef34480f6134efc0ddf2f1 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[elezar]

/ok-to-test e2e39b4

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2874.docs.buildwithfern.com/openshell

[elezar]

/ok-to-test fa02b7d

[elezar]

/ok-to-test 1ca8c32

[elezar]

/ok-to-test 5c8c586