feat(gateway): publish accepted supervisor service routes for discovery #4667

• Parent: Sandbox Service Exposure #4310
• Dependencies: feat(supervisor): add an independent sandbox application listener #4666.

User Story

I use OpenShell to run sandboxed applications behind independently operated ingress. I need ingress to find the supervisor that currently owns each declared service and stop routing when that ownership or installation is no longer valid.

Problem Statement

A reachable supervisor listener does not tell a router which routes are actually installed, which runtime owns them, or when the information expires.

Impact / Why This Matters

Static endpoint mappings become stale during sandbox restarts and gateway ownership changes. A declaration alone cannot establish a safe routing target.

Proposed Design

Supervisors advertise installed service routes over their authenticated gateway session. The gateway validates declarations, ownership, generation, session, revision, and expiry before exposing read-only discovery snapshots and watches. Advertised addresses come from trusted operator/driver configuration and reach supervisor listeners, never arbitrary workload ports. The advertised supervisor port derives from openshell.supervisor.app_listener.port, introduced in #4666; address configuration must not independently hardcode a conflicting port.

Initially require one explicitly named workspace and existing authorized workspace read access. Watches send complete replacement snapshots, have a documented lifetime and resource limits, and recheck authorization. Consumers discard expired routes; discovery failures do not trigger a gateway fallback.

All-workspaces discovery authorization is #4668. A reference consumer/proxy is #4669. New public ingress URLs and presentation status are #4670.

Suggested UX

Read discovery through GetServiceRouteSnapshot or WatchServiceRoutes with:

{
  "workspaceScope": {
    "workspace": "default"
  }
}

Responses identify workspace, sandbox/service, hostname, owning supervisor, reachable app address, revisions, runtime generation, and expiry. An advertised route proves installation evidence, not application health.

Acceptance Criteria

• Only authenticated current owners can advertise installed declared routes; advertisements cannot broaden declarations.
• Snapshot/watch require explicit workspace scope and enforce authorization before disclosing routes.
• Ownership replacement, deletion, rejected configuration, and expiry withdraw routes; stale writers cannot republish them.
• Advertisement updates use sandbox mutation guards and respect concurrent policy/declaration changes.
• Advertised supervisor endpoints use the configured app-listener port, including nondefault values; conflicting port configuration is rejected.
• Snapshot construction, stored advertisement collection, watches, and refresh work are bounded and documented.
• Initial and subsequent watch snapshots replace client state; expiry and outage behavior is tested.
• Tests cover cross-workspace denial, owner/session/generation fencing, recreation, concurrent mutations, and gateway ownership changes.
• The feature is demonstrated without requiring the OpenShell reference proxy or new CLI URL/status modes.

Alternatives Considered

Static supervisor mappings do not follow ownership. Publishing declarations without installation evidence exposes stale targets. Routing each request through the gateway preserves the original data-plane bottleneck. An ingress discovery adapter can consume this API; middleware and providers do not replace its ownership and authorization checks.

Agent Investigation

Implement advertisement validation and discovery collection with ownership fencing, bounded resource use, and sandbox mutation guards as part of this issue. Include these checks in the initial implementation and its regression tests.