fix(supervisor): preserve standard sbin paths in sandbox shells

[elezar]

Summary

Preserve standard sbin directories in supervisor-launched sandbox child shells so CDI-injected tools such as /usr/sbin/nvidia-smi remain discoverable on Orin systems.

Related Issue

No issue required: small localized regression fix discovered while validating stacked PR #2265 on an Orin Docker GPU gateway.

Changes

• Added supervisor child PATH normalization helpers for /usr/local/sbin, /usr/sbin, and /sbin.
• Installed an idempotent profile.d snippet and append the same repair to existing sandbox .bashrc files before child processes are exposed.
• Hardened startup-file repair so it skips symlinks, parent-directory symlinks, and non-regular startup files instead of following image-controlled paths as root.
• Wrapped supervisor-launched shell -c entrypoints and SSH exec/login-shell commands so PATH repair runs after shell startup files.
• Normalized provider-supplied PATH values on both entrypoint and SSH execution paths.
• Added focused unit tests for PATH normalization, startup snippet idempotency, startup symlink handling, entrypoint shell wrapping, provider PATH handling, and SSH child env handling.

Testing

• mise x -- cargo test -p openshell-supervisor-process startup_snippet
• mise x -- cargo test -p openshell-supervisor-process symlink
• mise x -- cargo test -p openshell-supervisor-process inject_provider_env_appends_standard_sbin_to_path
• mise x -- cargo clippy -p openshell-supervisor-process --all-targets -- -D warnings
• Static arm64 supervisor rebuild via PREBUILT_ARCH=arm64 bash tasks/scripts/stage-prebuilt-binaries.sh supervisor-output
• Docker GPU e2e on Orin against local dev gateway: 10 passed / 0 failed
• mise run pre-commit passes
  • Attempted again on 2026-08-21; blocked by existing local setup issues: Helm lint reports chart metadata missing postgresql, and workspace Rust lint hits a stale sqlx_macros artifact requiring GLIBC_2.39.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)