poc: Use a unified mechanism for build, test, packaging, and release

[krishicks]

Summary

Today, OpenShell has several overlapping sources of build and validation behavior:

• mise defines both developer tooling (Rust and Python versions, etc), and task entry points such as mise run rust:format:check.
• GitHub Actions owns much of the release build, packaging, and release validation logic.
• Some release checks can only be reproduced by re-running CI, even when the underlying assertion could be run locally.

This POC starts moving those responsibilities into shared, locally runnable entry points.

The direction is:

• Use Nix as the source of the development environment via nix develop, and eventually as the source of tools installed in the CI image.
• Use cargo xtask as the task runner that replaces mise run over time.
• Use Dagger for reproducible release build and packaging steps that can run locally as well as in CI.
• Use Lima VMs for smoke tests that need realistic guest environments, such as package installation, systemd user services, rootless Podman, sandbox creation, and eventually SELinux-focused scenarios.

This PR is an incremental slice of that migration. It does not remove mise yet. Instead, it adds the first shared entry points:

• Dagger functions for building Linux CLI binaries and assembling Debian packages. This only builds the CLI at present; it requires the gateway and driver-vm binaries to be provided.
• A cargo xtask release-smoke-test command that accepts a provided .deb, installs it in a Lima VM, starts the packaged gateway, creates a sandbox, and verifies that undeclared network egress is denied.
• A Release Canary job that downloads the deb-linux-amd64 artifact from the triggering Release Dev run and invokes the same xtask smoke test used locally.

The intent is that GitHub Actions increasingly orchestrates the same build and validation graph developers can run themselves, rather than being the only place that knowledge exists.

Related Issue

This is a POC implementation of #2204.

Changes

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.