bug(sandbox): supervisor hardcodes /bin/bash and fails to start on images without bash (e.g. Alpine) #3146

User Story

As an OpenShell user running a sandbox from a minimal base image (e.g. Alpine), I want the sandbox to start using a shell the image actually provides, so that sandbox creation doesn't fail on images that don't ship bash.

Problem Statement

The supervisor invokes /bin/bash for the default sandbox session (/bin/bash -l) and for the interactive SSH shell. On an image that doesn't provide bash — a stock Alpine ships only /bin/sh (BusyBox ash) — the entrypoint spawn fails and the pod crash-loops. The surfaced error is an opaque failed to spawn sandbox entrypoint process: No such file or directory (os error 2) that never names the missing binary.

Impact / Why This Matters

Users cannot run a sandbox from a stock Alpine (or any bash-less) image. The failure is a bare ENOENT with no indication that bash is the missing dependency, so it is very hard to diagnose (it looks like a musl/loader or workdir problem — it is neither). This blocks defaulting to Alpine (#3116) and BYOC on minimal bases.

Acceptance Criteria

• A sandbox created from a stock Alpine image with no explicit command starts successfully.
• The default session and interactive SSH shell work on an image that provides only /bin/sh.
• When the target shell is absent, the error names the missing shell instead of a bare ENOENT.
• Existing bash-based images continue to work unchanged.

Reproduction Steps

1. Deploy a gateway with the Kubernetes compute driver.
2. openshell sandbox create --from public.ecr.aws/docker/library/alpine:3.21 -- /bin/sh -c "echo hi"
3. The agent container crash-loops; logs show failed to spawn sandbox entrypoint process: No such file or directory (os error 2).
4. Instrumenting Process::spawn (crates/openshell-supervisor-process/src/process.rs) shows program="/bin/bash" args=["-l"], program_exists_in_parent=false (NotFound), cwd_exists_in_parent=true.

Environment

• OpenShell: main
• Deployment: OpenShift (ROSA HCP), Kubernetes compute driver, sidecar topology
• Sandbox image: public.ecr.aws/docker/library/alpine:3.21

Additional context

Confirmed not a libc issue — busybox:glibc fails identically to busybox:musl; Debian-based images (which ship bash) work. Relevant code: openshell-sandbox/src/main.rs (default /bin/bash -l), openshell-supervisor-process/src/ssh.rs (Command::new("/bin/bash")), SHELL=/bin/bash in ssh.rs and process.rs.

Part of #3116 (retire community images and default to Alpine); related to the iproute2/ip netns dependency noted there.