test(testkit): add the shared harness helpers e2e/rust tests need #5296

User Story

I'm moving e2e/rust tests onto testkit. Most of those tests rely on shared helpers in e2e/rust/src/harness/. I need to know which ones testkit or a support crate already covers and add the missing ones once, so each batch doesn't invent its own.

Description

Inventory every helper in e2e/rust/src/harness/ and mark it as one of:

1. Covered by testkit today (for example cx.sandbox(...), cx.cli(...), cx.track / cx.adopt, cx.exec, poll_until, Gateway::wait_ready).
2. Covered by an existing support crate (tests/support/container-engine, tests/support/podman, tests/support/keycloak).
3. Missing. Add each one to testkit or a tests/support/<name> crate.

Candidates to check, from the harness/ modules:

• sandbox.rs: SandboxGuard create variants (keep, detached, with uploads), upload, download, exec, spawn_forward. A CLI sandbox create-and-track helper is the one nearly every port needs, so land it first.
• container.rs: ContainerEngine, ImageGuard, SupportContainer, HostSupportContainer, ContainerHttpServer, and the driver checks e2e_driver / is_e2e_driver. Compare with tests/support/container-engine.
• host_process.rs: HostPythonFixture.
• gateway.rs: ManagedGateway start/stop, used by gateway reconfiguration tests. This likely belongs with the gateway-control family, not here.
• cli.rs, binary.rs, port.rs, output.rs: CLI wait helpers, find_free_port, wait_for_port, strip_ansi, extract_field.

This is different from the Keycloak pattern (#4891). Keycloak is an environment service: the tmachine environment starts it and publishes OPENSHELL_TEST_* variables, and the test reads them. These helpers are in-test code that a test calls itself. A throwaway server per test belongs in a helper. A heavy shared service belongs in an environment.

Context

• Use credential_gating (after test(e2e): split credential_gating into independent parallel tests #5264) as the pilot port. Record what it needs that testkit lacks, and add only that.
• Out of scope of test(tmachine): prepare runner environments for the e2e/rust migration #5275, which lists a shared fixtures crate, a driver-detection helper and a CLI create-and-track helper as follow-ups.
• Helpers arrive with the first batch that needs them, not ahead of time, unless the inventory shows most batches need them.

Part of #5281.

Definition of Done

• A table in this issue maps each e2e/rust/src/harness helper to covered, support crate, or missing.
• The missing helpers that the pilot port needs are in testkit or tests/support, with their own tests.
• The remaining missing helpers are listed with the batch that first needs each.