fix(control-plane): pin the sandbox runtime image alongside the supervisor

[rh-amarin]

Problem

After the OpenShell v0.1.2 bump (#374), every new sandbox stays in Provisioning and E2E / Kind fails at "Sandbox did not become ready within 180s". The sandbox os-supervisor pod exits with attachment denied: boundary process leaf: control request payload digest mismatch.

In the v0.1.2 chart a sandbox has a control-side supervisor and a workload-side sandbox runtime that speak a versioned boundary protocol. We pin the supervisor to v0.1.2-rhaiv.0 but never set sandboxRuntime.image, so the chart default applies: NVIDIA's moving ghcr.io/nvidia/openshell/sandbox:dev. Upstream changed the boundary protocol after our pins were cut, so the two ends no longer agree.

Fix

• New optional GATEWAY_SANDBOX_RUNTIME_IMAGE, passed to the chart as sandboxRuntime.image.{registry,repository,tag}. Unset falls back to the chart default.
• Pinned to quay.io/opendatahub/odh-openshell-sandbox:v0.1.2-rhaiv.0 (same build date as the supervisor) in the base and IBM manifests.
• Tracked in OPENSHELL_VERSION, scripts/sync_openshell_version.py, the renovate group, README, the gateway spec, and the ibm-cluster/update-openshell skills so it bumps with the supervisor.

Testing

• New unit tests for the Helm values and image validation; make lint and go test ./... in components/control-plane pass.
• Reproduced on a live Kind VM: sandbox stuck in Provisioning on baseline main; after setting the runtime image to odh-openshell-sandbox:v0.1.2-rhaiv.0 in the gateway config a new sandbox reached Ready within ~10s and both pods ran v0.1.2-rhaiv.0.
• The full Kind E2E has not been run against this branch yet; CI will.

Unblocks #384, whose only failing check is this sandbox step.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 114fe218-8bc3-44bd-89f3-bd918a16199a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[hypershell-delivery]

Amber review

Status: Complete

View the submitted review.

[hypershell-delivery]

Verdict

This revision cleanly pins GATEWAY_SANDBOX_RUNTIME_IMAGE, threading it env -> GatewayConfig -> Helm values with matching validation and tests, faithfully mirroring the existing supervisor/gateway image plumbing (splitImageRefFull, ValidateImageReference, StaticImageDefaults). The one prior concern is now addressed by a chart-render test; the only open item is a cross-PR ownership decision on the same deployment manifest.

What looks good

• The new commit test(control-plane): render the vendored chart to verify the sandbox runtime pin adds TestBuild_SandboxRuntimeImageRendersInChart, which renders charts/openshell with the builder's values and asserts sandbox_runtime_image = "quay.io/test/sandbox:v1" reaches the gateway config. This proves the value key is consumed, not just emitted.
• Input validation is guarded by a non-empty check, so the optional chart-default fallback is preserved and the new validation is reachable via ValidateGatewayConfig.
• Error wrapping (fmt.Errorf("invalid sandbox runtime image: %w", err)) follows convention; no panic, no secrets, no security-context surface touched. Registry-with-port cases are handled by the shared splitImageRefFull.
• Renovate custom manager + group, sync_openshell_version.py MANAGED_FILES, OPENSHELL_VERSION, README env table, the IBM overlay/skill, and the gateway spec are all updated together, keeping image references consistent across the stack.

Cross-PR coordination

Another open pull request deletes deploy/base/control-plane/deployment.yaml as an orphaned, drifted manifest, establishes deploy/base/platform-resources/controller.yaml as the single source of truth for image pins, and adds a make check-deploy-orphans gate (scripts/check_deploy_orphans.py) that fails on any unreferenced deploy/base YAML. This PR does the opposite for that same file: it adds the new GATEWAY_SANDBOX_RUNTIME_IMAGE env var to deploy/base/control-plane/deployment.yaml and registers that path in scripts/sync_openshell_version.py MANAGED_FILES. These are incompatible plans for the same file and need a maintainer decision on merge order and ownership: if the deletion PR lands first, this PR's edit to that file is lost, its sync-script entry points at a missing file, and the new orphan gate is unaffected but the managed-files list is stale; if this PR lands first, the other PR must carry the new env var forward onto platform-resources/controller.yaml (already the source of truth) and drop the control-plane/deployment.yaml entry from MANAGED_FILES.

Previous concerns

• Verify the chart consumes a top-level sandboxRuntime.image - Addressed. The value path sandboxRuntime.image.{registry,repository,tag} set in components/control-plane/internal/helm/values.go:141-143 matches the vendored chart: charts/openshell/templates/_helpers.tpl:189-194 (openshell.sandboxRuntimeImage) reads exactly those keys, and charts/openshell/templates/gateway-config.yaml:146 renders them into sandbox_runtime_image. The new TestBuild_SandboxRuntimeImageRendersInChart (components/control-plane/internal/helm/values_test.go) renders the chart and asserts the pin reaches the gateway config, so a wrong key would now fail rather than silently no-op. See the existing inline thread for the original discussion.

Findings Summary (ordered by severity, highest first)

No new findings. The single prior finding is resolved.

Convention Checklist

Convention	Result
No panic() in production code	Pass
Errors wrapped with fmt.Errorf context	Pass
Input validated (image reference)	Pass
No secrets in logs or responses	Pass
Reconcile pattern / config-not-code	Pass
Image references consistent across manifests	Pass
Tests cover new behavior (builder + chart render)	Pass
Test Diff Scrutiny (no silently flipped assertions)	Pass