test(oci): move OCI image USER/WORKDIR checks into a shared tmachine feature suite #4346

User Story

I need image USER and WORKDIR regression coverage that runs the same way on every container runtime, so a Podman regression is caught as reliably as a Docker one.

Description

Move the OCI image identity and workspace tests out of the legacy Rust e2e test (e2e/rust/tests/custom_image.rs) and into a new oci-image feature suite under tests/suites/features. The suite runs through the installed OpenShell CLI on tmachine, on Docker rootful, Podman rootful, and Podman rootless.

Today these checks only run against Docker, through a wrapper-managed gateway instead of an installed package. They cannot catch a Podman regression, and they do not exercise the packaged CLI and gateway that users install.

The suite expects an unwritable image WORKDIR to fail with WorkspaceValidationFailed on both runtimes. Today Docker and Podman do not report that condition reliably, so this work also makes both drivers report it, with a fixed message.

Context

• Docker/Podman slice of test(e2e): add cross-driver image-to-sandbox conformance #2422 (cross-driver image-to-sandbox conformance), tracked under test: define and track OpenShell testing strategy #3954. VM, Kubernetes, and OpenShift coverage remains in test(e2e): add cross-driver image-to-sandbox conformance #2422.
• Related to test(podman): run existing Podman behavioral e2e coverage in CI #3712. test(podman): run the e2e binaries that pass in the tmachine guest #4422 adds podman_oci_identity to the rootless tmachine e2e lane; this work keeps that test limited to Podman-specific checks.
• Split from feat(podman): honor OCI image working directories #3801. Builds on refactor(sandbox): remove unreachable root-side identity and workspace code #3979, fix(podman): create managed workspace volumes owned by the workload identity #3981, and feat(podman): honor OCI image working directories #3982 (Podman OCI WORKDIR, which closed feat: honor OCI WorkingDir for Docker and Podman workspaces #2526).
• Implemented in test(oci): add a shared Docker and Podman suite for image USER and WORKDIR #3931.
• ARM64 coverage runs the same suite through the existing ARM64 Docker e2e workflow until tmachine supports ARM64.
• Only the Podman supervisor identity and capability checks stay in e2e/rust/tests/podman_oci_identity.rs.

Definition of Done

• An oci-image feature suite covers image USER and WORKDIR handling: custom workdirs with named and numeric users, the default managed workspace, rejection of an unwritable workdir, and file transfer into the workspace.
• Every scenario checks that the workload has no capabilities, has no-new-privileges set, cannot read the sandbox credentials, and that a custom WORKDIR is not a mount. One scenario also inspects the containers the driver created and checks that the workload runs the pinned image ID with no network and no supervisor credential mounts, and that the supervisor is a separate non-root container.
• Docker and Podman report an unwritable image WORKDIR as WorkspaceValidationFailed, with a fixed message that does not include supervisor output.
• The suite runs in branch, release-dev, and release-tag CI on Docker rootful (DEB), Podman rootful (RPM), and Podman rootless (RPM) tmachine lanes.
• ARM64 Docker coverage is preserved.
• The legacy custom_image Rust e2e test, its Cargo target, and helpers used only by it are removed, and podman_oci_identity keeps only checks the shared suite cannot run.
• TESTING.md explains how to run the suite.