test(tmachine): add Fedora RPM package installer

[elezar]

Summary

Qualify fresh OpenShell RPM installations on Fedora with both rootful and rootless Podman, using immutable candidate packages and matching runtime images. DEB and RPM installers share packaged-gateway setup and override only the candidate runtime images, leaving gateway driver and socket selection to autodetection.

Related Issue

Contributes to #3454: RPM installation-profile qualification and candidate-artifact wiring. The broader installation-profile policy and remaining DEB/RPM acceptance criteria stay tracked in that issue.

Merge this PR before #3521. That PR retains RPM upgrade-source selection and continuity assertions but consumes this PR's installer, candidate RPM build job, and artifact-staging input. Once this merges, update #3521 with main before running its upgrade lanes; preserve the fresh-install and upgrade rows when resolving workflow matrices.

Changes

• Register an rpm installer that installs candidate CLI and gateway packages and starts the packaged user gateway service.
• Use RPM installation for both Fedora conformance environments in branch, Release Dev, and Release Tag qualification; retain Ubuntu DEB and K3s lanes.
• Build candidate RPM artifacts and stage exactly one CLI/gateway pair without hardcoding architecture; reject missing, duplicate, or mismatched-architecture packages.
• Share runtime-image loading, packaged-service startup, and client registration between DEB and RPM installers. Override only sandbox and supervisor images in the qualification configuration.
• Support rootful Podman through the root user service and provide the test client with its client TLS credentials.
• Document both Fedora RPM qualification environments in CI.md and the release-canary contributor skill.

Testing

• mise run pre-commit passes with the compiler-cache wrapper disabled after a local sccache permission failure.
• nix fmt tests/config.nix and nix build .#tmachine-config --no-link pass.
• actionlint passes for the four changed branch/release/input workflows.
• Ansible syntax checks pass for both package installers.
• RPM staging smoke checks pass for x86_64 and aarch64 pairs and reject missing, duplicate, or mismatched-architecture packages before moving files.
• Runtime detection and image-only template checks pass for Docker and both Podman modes; all three conformance matrices contain exactly two Fedora RPM lanes.
• Live Fedora tmachine installation/conformance has not been run locally.
• Full local CI: the earlier Nix run failed in the unchanged supervisor test tcp_readiness_listener_accepts_ipv4_regardless_of_bindv6only because the readiness port was already in use (127 other supervisor tests passed).

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Contributor CI documentation and relevant skill reviewed/updated.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4025.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 86a5838. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.