bug(docker): Compose gateway cannot create sandboxes without gateway JWT

User Story

As a local OpenShell user, I want the checked-in Docker Compose quickstart to create Docker-backed sandboxes so that I can evaluate OpenShell without manually constructing internal gateway authentication configuration.

Problem Statement

The gateway started from deploy/docker/docker-compose.yml loads deploy/docker/gateway.toml, which selects the Docker compute driver but does not configure [openshell.gateway.gateway_jwt] or provision its key material. The current Docker driver requires gateway JWT authentication for sandbox supervisors, so the gateway starts but rejects every Docker sandbox before provisioning.

Impact / Why This Matters

The repository's Docker Compose quickstart appears healthy and accepts CLI connections, but its core sandbox-creation workflow is unusable. Users encounter an internal authentication prerequisite only after attempting to create a sandbox. The current workarounds are to abandon the Compose deployment for a package-managed gateway or manually determine how to generate, mount, and configure JWT keys; neither is documented by the quickstart and manual security configuration is error-prone.

Acceptance Criteria

• A clean deploy/docker startup provisions or loads the gateway JWT material required by the Docker driver without committing private keys.
• Following the Compose quickstart can create a Docker-backed sandbox successfully.
• The Compose deployment and its documentation describe any generated files, mounts, or initialization step required for gateway JWT authentication.
• Existing gateway and supervisor authentication boundaries remain enforced.

Reproduction Steps

1. Check out OpenShell main at or after 2f7fb655.

2. Run cd deploy/docker && docker compose up -d.

3. Register it with openshell gateway add http://localhost:8080 --name openshell-docker.

4. Run:

   openshell sandbox create \
     --name jwt-repro \
     --from ghcr.io/nvidia/openshell-community/sandboxes/base:latest \
     --detach \
     -- sleep infinity
   

5. Observe that sandbox creation is rejected before provisioning.

Environment

• OpenShell CLI: 0.0.111
• OpenShell source: main at 2f7fb655
• OS: macOS 26.5.2 on Apple Silicon
• Runtime, deployment, or integration: deploy/docker, Docker 29.5.2 through Colima

Logs

status = StatusCode.FAILED_PRECONDITION
details = "docker sandboxes require gateway JWT auth; configure [openshell.gateway.gateway_jwt]"

Start with deploy/docker/docker-compose.yml and deploy/docker/gateway.toml, then run the listed Compose startup and sandbox-creation reproduction. Trace how the Docker driver expects gateway JWT material and how the Compose deployment provisions or mounts it. Done means a clean deploy/docker startup can create a Docker-backed sandbox, documents generated files or initialization, and keeps authentication boundaries enforced.