test(e2e): decide which e2e/rust tests to port and in what order #5297

User Story

I'm retiring e2e/rust (about 70 test files). Not every file should move: some duplicate tests already on testkit, some are benchmarks, and some test the environment instead of the product. I need a per-file decision and a batch order so each migration PR stays small.

Description

Sort every file in e2e/rust/tests/ into keep, drop or merge, and assign kept files a destination and a batch. Judge each file with three questions:

1. Does a ported test already assert this?
2. Does it test product behavior, or the test environment?
3. Would a regression here surprise us in production?

If the answer to the third is no, drop it.

Starting point, from file names and a skim of a few files (not yet from reading every test body):

• Conformance candidates (every driver must pass): policy and network enforcement (landlock, bypass_detection, no_proxy, policy_activation, live_policy_update, proxy_egress_pipeline, forward_proxy_*, transparent_tcp, websocket_conformance), sandbox API (sandbox_labels, sandbox_templates, ssh_host_identity, port_forward, upload_create, rootfs_tar, ephemeral_cleanup, listener_lifetime), providers and credentials (provider_*, credential_gating, stable_external_placeholders, provider_token_exchange, service_bearer_passthrough, settings_management), workspace_lifecycle.
• Feature or driver candidates: oidc_pkce, additional_ca, config_push, local_driver_token_restart, otlp_relay, ocsf_*, mcp_sessionless, default_image; the kubernetes_*, workspace_namespace_* and credential_drivers files; podman_*, user_namespaces; docker_*, gateway_start; vm_*.
• Possible duplicates to diff before porting:
  • sandbox_lifecycle.rs: conformance lifecycle already covers restart of a stopped sandbox and delete while stopped. The canonical-main, detached-main, exec-recovery and large-output tests don't appear to be covered.
  • host_gateway_alias.rs and podman_host_gateway.rs: their first test checks the same host.openshell.internal contract as the host-gateway suite from test(tmachine): prepare runner environments for the e2e/rust migration #5277. host_gateway_alias.rs also covers EOF handling and provider bindings, which are separate.
  • user_namespaces.rs and podman_oci_identity.rs: overlap the ports from test(e2e): migrate the features and drivers suites to testkit #5137.
• Drop or keep out of CI: live_internet_traffic_perf and internet_network_perf (opt-in benchmarks that use the live Internet); docker_preflight (checks openshell doctor output without Docker, so it needs an environment with no Docker).
• Needs a decision on the setup: the three *_corporate_proxy.rs files (about 2,400 lines, mostly environment setup), gpu, core_dump_hardening, edge_tunnel_e2e.
• Heavy and last: kubernetes_shared_supervisor*, kubernetes_ha_rebalancing. These are slow, and the flake census shows Kubernetes lifecycle races, so port them last or only the ones guarding recent bugs.

Batches and their dependencies are in the "Migrating e2e/rust" table in #5281: a credential_gating pilot, then Podman, Docker and the common driver-agnostic files (in parallel, since they touch different crates), then gateway reconfiguration, then Kubernetes. Record each file's batch in that table's terms.

Context

• Depends on test(tmachine): prepare runner environments for the e2e/rust migration #5277 (Python image, host.openshell.internal on k3s) for tests that use them. Helpers come from the harness-helpers issue; runner timeouts and parallelism from the runner-knobs issue.
• Each batch deletes what it ports, so e2e/rust shrinks as the work lands.

Part of #5281.

Definition of Done

• Every file in e2e/rust/tests/ has a recorded decision (port, merge, drop, keep on host) with a reason.
• Each kept file has a destination family and a batch.
• Overlaps above are resolved by reading the test bodies.