fix(gateway): give image preparation its own deadline

[shiju-nv]

Summary

An uncached image can use the gateway's entire five-minute policy repair window before the supervisor starts. Give image preparation a persisted deadline, then start the existing repair window when the current supervisor sends its first authenticated configuration report. Preparation timeouts direct users to image preparation and supervisor startup diagnostics and the preparation budget.

Related Issue

Closes #3952, accepted as part of #3955. The maintainer's accepted triage identifies both premature cold-image timeout and incorrect configuration-repair guidance.

The gateway invokes StopSandbox after timeout. The VM worker and staging cleanup implementation belongs to #3953.

Changes

• Add image_preparation_timeout_seconds, defaulting to 1800 and restricted to 1 through 86400. Persist each attempt's absolute deadline so progress, configuration writes and restarts cannot extend preparation.
• Start admission timing on authenticated supervisor registration. Preserve renewal for committed configuration changes and the first rejected load; duplicate reports and no-op writes do not renew it.
• Release a recovered start operation when its persisted deadline expires, so cleanup can acquire the lifecycle lock. Retain timeout diagnostics and cleanup status for inspection and explicit retry.
• Report ImagePreparationTimedOut separately from admission timeout. Show the phase in CLI JSON and TUI notes, give each timeout the appropriate recovery guidance, and update bindings and lifecycle documentation.

Testing

• Checks appropriate to the affected code and behavior pass.
• Unit tests added/updated.
• E2E tests added/updated (if applicable). A successful physical-Mac cold preparation exceeding five minutes remains unverified for this candidate.

The resolved merge passed the server, CLI and TUI package check, formatting, documentation checks, and six exact library tests covering cold preparation, registration timing, stalled-start cleanup, and phase-specific CLI output. Independent review found no unresolved findings. Branch Checks passed for signed commit 87755ffe78f, including Rust lint, tests and build modes on both Linux architectures and macOS, plus protobuf compatibility.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO). The published implementation and correction commits include Signed-off-by: Shiju <shiju@nvidia.com> and have verified SSH signatures.
• Architecture docs updated (if applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4038.docs.buildwithfern.com/openshell