feat(sandbox): add --no-login-shell to skip shell startup files on exec

[letv1nnn]

Summary

sandbox exec always ran commands through a login shell (bash -lc), so sandbox-user startup files (.profile, .bash_profile, .bashrc) were sourced before the requested command — letting them alter its output, create files, or block it, which made exec unsuitable as a trusted execution boundary for automation and managed checks. This adds an opt-out (--no-login-shell / no_login_shell) that runs the command without sourcing those files, while the login-shell default is preserved for existing callers.

Related Issue

Closes #2668

Changes

• Add no_login_shell field to ExecSandboxRequest in proto/openshell.proto (default false preserves current login-shell behavior).
• Gateway (openshell-server): read the field and signal it to the supervisor over an SSH OPENSHELL_NO_LOGIN_SHELL env request, sent before exec on both the non-interactive and interactive russh paths.
• Supervisor (openshell-supervisor-process): store the flag from env_request, thread it through start_shell to the PTY and pipe spawn sites, and select bash -c instead of bash -lc when set.
• CLI (openshell-cli): add --no-login-shell flag to sandbox exec, wired through to both the streaming and interactive request builders.
• SDKs: expose the option in the Rust (ExecOptions.no_login_shell), Go (ExecOptions.NoLoginShell), Python (no_login_shell kwarg), and TypeScript (noLoginShell) exec APIs. - Docs: document the flag and tradeoff in docs/sandboxes/manage-sandboxes.mdx; note the login-shell default and SSH env carrier in architecture/sandbox.md.

Reproduction

Podman-backed sandbox with a profile marker seeded in ~/.bash_profile (echo PROFILE-RAN):

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.