chore(build): remove stale static-supervisor leftovers

The opt-in glibc-static supervisor variant from #2682 is gone: the Nix
release builds (#2977) removed it from CI and the supervisor Dockerfile,
and the RFC 0012 sandbox split (#2942) removed it from the staging script.
The split also moved the binary that runs inside workload images to
openshell-sandbox; the supervisor now runs from its own image and is
dynamically linked. A few places still describe the old model:

- skills/debug-openshell-cluster told operators to check that
  supervisor_image contains a static /openshell-supervisor. Ask instead for
  a supervisor from the matching release whose loader and shared libraries
  are available inside that image, and give a `--version` check that shows
  both. The static requirement for /openshell-sandbox is unchanged.
- verify-static-binary.sh justified its check with the supervisor and the
  glibc-static variant. Describe the property it enforces instead, with
  the musl sandbox runtime as the main example.
- stage-prebuilt-binaries.sh kept an unreachable gnu-static case in
  target_triple.

No behavior change: resolve_component only ever selects gnu or musl.

Signed-off-by: Emilien Macchi <emacchi@redhat.com>

Author: EmilienM

skills/debug-openshell-cluster/SKILL.md

@@ -260,7 +260,7 @@ Common findings:
   gateway's primary endpoint is reachable from a host-networked container.
 - Sandbox runtime image exits before printing `openshell-sandbox --version`: verify the configured image contains a static executable at `/openshell-sandbox`.
 - A sandbox with explicit `protocol: tcp` endpoints fails before workload readiness: confirm the selected isolation backend advertises TCP mediation, then inspect the sandbox and supervisor logs for protected-channel setup or listener failures. A driver that cannot supply the required outer egress fence and authenticated runtime channel must reject the policy before starting the agent.
-- Supervisor runtime validation fails: verify `supervisor_image` contains a static `/openshell-supervisor` executable from the same release as the sandbox runtime.
+- Supervisor runtime validation fails: verify `supervisor_image` contains an `/openshell-supervisor` executable from the same release as the sandbox runtime, and that the dynamic loader and shared libraries it links against are available inside that image. `docker run --rm --network none --entrypoint /openshell-supervisor <supervisor_image> --version` should print that release; a `no such file or directory` error for a binary that exists means the loader or a library is missing. The supervisor runs from its own image and does not need to be static; only `/openshell-sandbox` must be.
 - The sandbox fails its enforcement probe: inspect the sandbox log for the exact nested seccomp user-notification, task-memory, Landlock, loopback DNS, or socket-injection check that failed. Do not add capabilities or switch to an unconfined seccomp profile; use a runtime whose default profile permits the unprivileged probe.
 - A GPU sandbox fails because Docker reports no discovered NVIDIA CDI devices: verify `.DiscoveredDevices` contains entries such as `nvidia.com/gpu=all`, verify `/etc/cdi` or `/var/run/cdi` contains a generated NVIDIA spec, and check that `nvidia-cdi-refresh.service` and `nvidia-cdi-refresh.path` from NVIDIA Container Toolkit are enabled and healthy. The service is a one-shot unit, so `inactive (dead)` can be normal after a successful run; use `systemctl status` and `journalctl` to distinguish success from a skipped or failed refresh. Restart `nvidia-cdi-refresh.service` to regenerate missing or stale CDI specs, then restart or reload Docker and re-check `docker info`.
 

tasks/scripts/stage-prebuilt-binaries.sh

@@ -28,9 +28,7 @@ target_triple() {
   local suffix
   case "$libc" in
     musl) suffix=musl ;;
-    # gnu-static builds the GNU target with +crt-static, so it shares the
-    # gnu triple.
-    gnu|gnu-static) suffix=gnu ;;
+    gnu) suffix=gnu ;;
     *)
       echo "unsupported libc: $libc" >&2
       exit 1

tasks/scripts/verify-static-binary.sh

@@ -6,11 +6,12 @@ set -euo pipefail
 
 # Verify a binary is a genuine, complete, fully static executable.
 #
-# The supervisor is executed from inside arbitrary sandbox images (Docker
-# extraction, Podman image volumes, the Kubernetes copy-self path), so any
-# dynamic linkage breaks it on musl-based images and on images whose glibc is
-# older than the build host's. Both supported supervisor libc variants (musl
-# and glibc-static) must therefore produce a static binary.
+# Callers pass binaries that must run without a dynamic loader, such as the
+# musl sandbox runtime (openshell-sandbox). It is executed from inside
+# arbitrary workload images (Docker extraction, Podman image volumes, the
+# Kubernetes copy-self path), so any dynamic linkage breaks it on musl-based
+# images and on images whose glibc is older than the build host's. Other
+# callers include the release prover and e2e fixtures.
 #
 # This check exists because the failure is silent: `zig cc` accepts `-static`
 # for `*-linux-gnu` targets and emits a dynamically linked binary anyway, so a
@@ -57,7 +58,7 @@ if [[ -z $READELF ]]; then
   host_os=""
   command -v uname >/dev/null 2>&1 && host_os=$(uname -s 2>/dev/null || true)
   # Skip only on a host positively identified as non-Linux — e.g. a macOS dev
-  # cross-building the Linux supervisor via cargo-zigbuild, where mise installs
+  # cross-building a Linux musl binary via cargo-zigbuild, where mise installs
   # no binutils. Linux (including CI), or any host whose OS cannot be determined,
   # fails closed so a missing inspector never silently passes. Static linkage is
   # still enforced in CI, which runs on Linux.