feat(ci): switch host gateway e2e helper to ghcr ci image after repo is public

[pimlock]

Problem Statement

The host gateway e2e tests currently use python:3.13-alpine for the temporary Docker-backed helper server. That works today, but it can be subject to Docker Hub pull limits in CI.

Once the repository is public, we should switch that helper to our own CI image at ghcr.io/nvidia/openshell/ci so the tests depend on the same registry and image family we already use in GitHub Actions.

Proposed Design

Update the Docker-backed helper in e2e/rust/tests/host_gateway_alias.rs to use:

docker pull ghcr.io/nvidia/openshell/ci

and then run the inline Python HTTP server from that image instead of python:3.13-alpine.

Keep the existing behavior:

• launch the helper with docker run -d --rm -p <host_port>:8000 ...
• wait for readiness from inside the helper container
• use the helper for both direct host.openshell.internal and inference.local e2e coverage

Alternatives Considered

• Keep using python:3.13-alpine indefinitely. This is simple, but it leaves CI exposed to external Docker Hub limits.
• Build a dedicated tiny test image. This adds maintenance overhead without much benefit once the shared CI image is publicly available.

Agent Investigation

We tried switching the helper image to ghcr.io/nvidia/openshell/ci:latest locally, but backed off because the repository is not yet public and we wanted the current branch to keep working immediately. The current Docker-backed helper approach is otherwise working; this follow-up is just to swap the image source once GHCR access is straightforward for all environments.

[pimlock]

The CI image is internal, so cannot be used for this.
We already started getting some CI failures due to docker rate limits, switched to ECR for E2E images to spread the load in the short term, but we will need to solve for this in the long term. That work is tracked separately though.

Short term fix: #369