fix(docker): use supervisor image path directly

[drew]

Summary

Use the supervisor image binary path at /openshell-sandbox for Docker supervisor extraction and validate that path in Docker image CI. Gateway Docker image builds and Debian release gateway binaries bake the matching supervisor image tag into the binary, so the Docker driver does not depend on :latest by default.

Related Issue

None.

Changes

• Use the shared /openshell-sandbox path constant when creating the Docker extractor container.
• Run Docker image smoke checks for pushed images as well as local builds, with the supervisor check explicitly invoking /openshell-sandbox.
• Bake the supervisor image tag into Docker image gateway builds and Debian release gateway binaries.
• Update runtime architecture docs and troubleshooting notes for supervisor image extraction.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1259.docs.buildwithfern.com/openshell