Spike: OpenShell behind a controller execution-backend feature flag (SDK now in-tree)

## Why now

The OpenShell Go SDK is now **integrated in-tree** in NVIDIA/OpenShell, with the first **beta scheduled ~mid-September** (per rhuss on #144, who invited us to try it and file issues). **ADR 0016 explicitly sanctions this** — its "Revisiting OpenShell — two separate bars" section permits evaluating OpenShell behind a non-default feature flag without a superseding ADR. This spike gathers the buy-in half of the trigger; flipping the default remains a separate decision needing a new ADR.

**Clock note:** the downstream OpenShift release that *includes* OpenShell isn't slated until ~February. That gates the **supported OCP-target** path only. Upstream, OpenShell installs via Helm + CLI on any cluster (ADR 0004), so integration and evaluation are **not** blocked by the OCP date. Installing beta OpenShell on stock OpenShift may be constrained by SCC/security hardening until productized, so OCP-target validation is out of scope here; vanilla k8s (Kind/minikube) is the target.

## The seam (why a flag is clean)

ADR 0016 already isolated it: `Agent.spec.gateways` / `AgentRun.spec.gateway` **name** a gateway; what it resolves to is controller-internal.

- **Flag off (default):** current path — controller creates `agents.x-k8s.io` Sandbox CRs; Gateway CRD injects `KONVEYOR_LLM_*` (ADR 0016).
- **Flag on:** controller uses the OpenShell Go SDK to create sandboxes through the gateway API; gateway names resolve to **OpenShell Gateway Services**; credentials handled by OpenShell's privacy router.

## Spike tasks (timeboxed — answer questions, don't productize)

- [ ] Install OpenShell (Helm + CLI) on a Kind/minikube cluster with the ImageVolume gate; document versions and steps.
- [ ] Stand up one OpenShell Gateway (one provider/model) via Helm.
- [ ] From a throwaway controller branch, create **one sandbox through the OpenShell Go SDK** for a minimal AgentRun, behind an `--execution-backend=agent-sandbox|openshell` (working name) flag.
- [ ] Verify the **privacy-router credential model**: confirm the agent process cannot read backend LLM credentials from its env (the isolation ADR 0016 lists as a dev-preview gap, and the core of #85).
- [ ] Confirm the harness↔goose ACP path (ADR 0008 tee) still works inside an OpenShell-created sandbox, or record what breaks.
- [ ] Note SDK ergonomics/gaps and file issues upstream on NVIDIA/OpenShell as invited.

## Deliverables

- A findings write-up (versions, steps, what worked, what didn't).
- A recommendation on: (a) whether to carry a feature-flagged OpenShell backend, and (b) whether it makes the goose-sidecar/setuid isolation machinery from the closed #142 unnecessary.
- If "yes, carry it": a **new ADR** (0017+, since 0016 is the Gateway CRD) covering the flagged backend; followed by implementation issues. Flipping the default is a further, separate ADR.

## Explicitly out of scope

- Making OpenShell the default backend.
- OpenShift-target install/validation (waits on the productized release).
- Removing the Gateway CRD or `agents.x-k8s.io` RBAC (the eventual #144 work, gated on this spike's outcome).

## Risks / notes

- OpenShell is alpha→beta; expect SDK/API churn.
- Two divergent execution paths (Sandbox creation, credential model, RBAC) — maintenance cost if carried.
- Requires OpenShell in any CI that exercises the flag-on path.

## References

- #144 (OpenShell deferred epic) · #85 (SCM + credential isolation, reconcile with OpenShell)
- ADR 0004 (OpenShell, deferred) · ADR 0016 (Gateway CRD interim; sanctions this spike)
- rhuss update: https://github.com/konveyor/agentic-controller/issues/144#issuecomment-5325000857
- NVIDIA/OpenShell (SDK in-tree)

Start by reading ADR 0016 and installing OpenShell with Helm and its CLI on a Kind or minikube cluster, recording versions and setup steps. Use a throwaway controller branch to create one minimal AgentRun sandbox through the OpenShell Go SDK behind the proposed execution-backend flag. Done means a findings write-up, credential-isolation and ACP results, SDK gaps, and a recommendation on whether a feature-flagged backend and follow-up ADR are warranted.

Written by the indexing model from the issue text.