codex/fix local driver session token e2e

[drew]

Summary

Align the local-driver restart E2E test with split Podman containers and finite launch-scoped session JWTs.

Related Issue

Stability investigation stacked on #3610 and ultimately #3583. The complete local Podman suite found that this test matched both workload and supervisor containers, expected a shell in the capability-free workload, and asserted the legacy non-expiring JWT contract against a finite session token.

Changes

• Select Podman containers by sandbox name and isolation role; use Podman's archive operation to confirm the workload has no JWT and read the supervisor token.
• Check that the launch-scoped session JWT expires within one hour, matching the current session-token contract; retain the terminal workload stop assertion.
• Clarify the legacy and launch-scoped token lifetimes in the gateway architecture documentation.

Testing

• mise run pre-commit: passed.
• mise run ci: passed on rerun. The first run hit an unrelated one-off managed_children::tests::child_pid_parser_observes_a_live_child failure; that test passed 100 isolated repetitions and the full rerun.
• Focused local Podman restart E2E: passed (1 test, 34.13s); CLI conformance passed.
• Complete local Podman E2E: restart test passed; later corporate proxy tests failed because their gateway-config fixture writes fields into an obsolete table. That separate fixture fix is next in the stack.

Checklist

• Signed-off conventional commit
• Documentation updated
• Full local CI passed
• Focused Podman E2E passed

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[drew]

Closing to narrow the automated flake investigation to the four selected fixes (#3583/#3588, #3598, #3604, #3608). The findings remain available here for later follow-up.