feat(gateway): add operation interceptors

[drew]

Summary

Implement RFC 0006 gateway operation interceptors and add a policy governance example interceptor that vends a default sandbox policy, governs GitHub/GitLab providers, and signs the vendored policy digest with an internal JWT workflow.

Related Issue

RFC 0006

Changes

• Add the interceptor proto, runtime crate, endpoint parsing, manifest validation, selector matching, failure policy behavior, patch handling, metrics, and gateway config support.
• Wire interceptor phases into sandbox, provider, provider profile, policy, and config write paths with credential redaction and secret-field patch rejection.
• Add docs for gateway interceptor configuration and architecture behavior.
• Add examples/policy-governance-interceptor with policy vending, provider lockdown, signature labels, JWT signing/verification, and an end-to-end smoke script.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated

Manual verification run locally:

• cargo fmt --all
• bash -n examples/policy-governance-interceptor/smoke.sh
• cargo test -p policy-governance-interceptor --message-format=short
• bash examples/policy-governance-interceptor/smoke.sh
• env CC=clang CXX=clang++ RUSTC_WRAPPER= cargo test -p openshell-interceptors -p openshell-server -p policy-governance-interceptor --features openshell-server/test-support,openshell-server/gh-release-z3 --message-format=short

mise run pre-commit was attempted twice locally. The default run failed because aws-lc-sys picked up /opt/homebrew/bin/gcc-15 and failed against the macOS SDK block syntax. The clang rerun got past that but failed because local z3.h is not installed. The focused Rust verification above uses openshell-server/gh-release-z3, matching the smoke build path.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1936.docs.buildwithfern.com/openshell