fix(tmachine): restore package-installed Podman qualification

[elezar]

Summary

Restore package-installed Podman driver qualification from #4107, which was reverted in #4206 after all three RPM lanes failed before executing their behavioral tests. The harness now follows the packaged service owner's actual XDG configuration path and supports services that run from defaults and gateway.env without a TOML file.

Related Issue

Follow-up to #3454 (already closed by #4107). This is a localized repair and reintroduction of that qualification harness; no new feature scope is added.

Original changes: #4107, test(tmachine): support package-installed Podman driver suites. Revert: #4206.

Changes

• Restore installer-published gateway metadata, installed CLI discovery, existing gateway registration and credentials, service restart, and journal collection from test(tmachine): support package-installed Podman driver suites #4107.
• Replace the obsolete /var/lib/openshell-qualification/gateway.toml assumption with the package service owner's XDG gateway.toml. Preserve the installed default profile; create a minimal versioned TOML only when a configured namespace profile needs an override and none exists.
• Support both rootful and rootless Podman E2E fixtures; load the workload image through the detected socket and run both image loading and the archive as the local tmachine user. Rootful guest setup grants socket access to the existing tmachine group and persists runtime-directory traversal across boots, preserving packaged tmpfiles cleanup rules and the tmachine gateway registration.
• Run the rootful/rootless driver namespace suites and rootless portable E2E suite with the RPM installer in branch CI.
• Document immutable candidate inputs and require the actual integration jobs to run and pass before merging. No configuration-mirroring tests or archive exclusions are added.

Testing

• Real local Fedora tmachine guests using QEMU/HVF on Apple ARM, with SELinux enforcing and guests run serially.
• Matching ARM CLI/gateway RPMs and runtime OCI images from successful current-main build 834b79a8c2351370e7c6c363423f5be18d440256 (run); existing Rust archives compiled from the same source. Standard E2E workload image built locally.
• Rootful RPM driver-podman: default, auto, keep-id, private; 8 test executions passed, zero skipped. Each profile creates a sandbox, verifies non-root workspace ownership/write access, compares its UID map with direct Podman, and deletes the sandbox.
• Rootless RPM driver-podman: all four profiles; 8 test executions passed, zero skipped.
• Rootful RPM e2e-podman: 27 tests passed as the local tmachine user with group socket access, the same 2 existing ignored tests skipped, in 526.292 seconds. Guest inspection confirmed nextest ran as tmachine. Final setup with the preserved packaged tmpfiles rules also passed all four rootful driver profiles (8 test executions, zero skips); an initial fresh-guest SSH startup timeout passed on retry.
• Rootless RPM e2e-podman: 27 tests passed, 2 existing ignored tests skipped (manual Internet benchmark and the old user_namespaces scenario), in 400.882 seconds initially; the review correction rerun also passed 27 tests with the same 2 skips in 440.918 seconds.
• Existing binary service fixtures: rootful and rootless driver namespace suites each passed all four profiles, 8 test executions per mode, zero skipped. Used the published ARM CLI and gateway binary extracted from the exact matching ARM RPM; this verifies fixture compatibility, not a separately published raw ARM gateway artifact.
• Affected Ansible entrypoint syntax checks, actionlint, Markdown lint, SPDX headers, and diff whitespace checks.
• mise run pre-commit passed, including the installed commit hook.
• mise run ci stopped on the unmodified macOS VM test driver::preparation::tests::completed_worker_without_descendants_keeps_successful_exit_status with Operation not permitted (220 VM tests passed). A targeted rerun passed; the full CI run did not complete.
• Actual x86 Branch Checks and Branch E2E passed on 860aa5318, including all three RPM driver-specific jobs (E2E run).
• Branch Checks and Branch E2E passed for the completed local-user socket access changes at 135ce70b9 (Branch Checks, E2E).
• Consolidated the series into two focused, signed-off commits; verified the final Git tree is identical to 135ce70b9. Pre-commit and both commit hooks passed.
• CI for the rewritten head (d598c036c) is pending. test:e2e remains enabled; require actual integration jobs to pass before merging. A green workflow with skipped jobs is insufficient.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Contributor testing and CI documentation updated; no public configuration/API changes.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied, but pull-request/4289 does not exist yet. A maintainer needs to comment /ok to test 221cf8a66951dd5e5f1e7d83289f5974825b6a7a to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[elezar]

/ok-to-test 221cf8a

[elezar]

/ok-to-test 860aa53

[SDAChess]

TESTING.md says e2e-podman requires rootless Podman, but this become adds a rootful path (and the PR description reports a rootful run passing). Should we document rootful as supported, or drop this branch and assert rootless?

[elezar]

Yes, I'm looking into it now.

[elezar]

Added the tmachine user to the podman group instead of requiring that the tests run as root.

[elezar]

/ok-to-test 135ce70