feat(sandbox): add tool adapter validation and fork-owned trust

[linuxdevel]

Summary

• add first-class sandbox tool adapter validation for claude and opencode, plus tool smoke workflow coverage
• wire cluster runtime-bundle defaults to fork-owned nvidia-container-toolkit GitHub Releases and move installer trust to linuxdevel/OpenShell plus checksum verification
• align installer tests, release workflows, docs, and risk notes with the active fork-owned checksum-only trust posture while preserving detached signing as backlog context

Test Plan

• bash e2e/install/bash_test.sh
• sh e2e/install/sh_test.sh
• bats tasks/tests/runtime-bundle-ci-workflow.bats
• cargo test -p openshell-providers providers -- --nocapture
• cargo test -p openshell-sandbox secrets -- --nocapture
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e --test tool_adapter_smoke --no-run
• workflow YAML validation for .github/workflows/branch-e2e.yml, .github/workflows/e2e-test.yml, .github/workflows/release-canary.yml, .github/workflows/release-dev.yml, .github/workflows/release-tag.yml
• live GitHub E2E evidence run against tool-adapter-phase1

[github-actions]

Thank you for your interest in contributing to OpenShell, @linuxdevel.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}