fix(podman): deliver sandbox JWTs as secrets

[maxamillion]

Summary

Deliver Podman sandbox JWTs through per-sandbox Podman secrets instead of host bind-mounted token files. This keeps bearer tokens out of host state files while preserving the supervisor's file-based token loading path.

Related Issue

Issue: #1909
PR: #2111

Changes

• Added Podman libpod secret create/delete client helpers.
• Create a per-sandbox JWT secret during Podman sandbox provisioning and clean it up on failures/deletion.
• Mount the JWT secret at the existing sandbox token file path and keep raw token values out of container env metadata.
• Updated Podman driver documentation to describe JWT secret delivery.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Additional validation:

• cargo test -p openshell-driver-podman
• Live local Podman API smoke checked secret create/delete and file-mounted secret readability.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[TaylorMutch]

/ok to test 6b45b14