fix(policy)!: reject unsupported TLS endpoint values

[lunarwhite]

Summary

The endpoint tls field now accepts only an omitted value, meaning auto-detect and terminate for inspection, or skip. terminate and passthrough became no-ops when termination became automatic, leaving a MED-severity deprecation warning as their only remaining effect; they are now rejected along with any other unrecognized value, and the warning machinery is deleted rather than upgraded.

Removing the field from an existing policy is exactly behavior-preserving, since parse_tls_mode already resolved both spellings to Auto. The schema break lands inside the pre-0.1.0 window rfc/0014-release-stability designates for finalizing interfaces.

Related Issue

Closes #3310

Changes

• Add validate_tls_mode as a tenth arm of validate_l7_endpoint_semantics, via a new tls field on L7EndpointFields. This covers gateway admission and stored reads, the supervisor's OPA-data load, and provider-profile lint in one place, and reuses PolicyViolation::InvalidL7Endpoint rather than adding a variant.
• Call validate_tls_mode directly in network_endpoint_from_json, the one boundary that cannot use the seam because agent-authored proposals validate field-by-field before a NetworkEndpoint exists. Without it an in-sandbox agent could author a value the gateway rejects.
• Delete both OCSF deprecation emitters in parse_l7_config, which now delegates to parse_tls_mode, and the deprecation warning in validate_l7_policies. parse_tls_mode keeps its lenient _ => Auto fallback, which inspects and so still fails closed.
• Delete effective_tls in merge.rs and the unreachable "TLS terminate" TUI annotation, both dead once the values are rejected.
• Remove six tls: terminate endpoints from providers/aws-s3.yaml. That file is compiled in and unwrapped by builtin_profiles(), so enforcing without cleaning it would panic the gateway on first catalog access — hence one commit.
• Remove six tls: none values from three SPIFFE example profiles, already invalid before this change but failing silently.
• Rewrite the TLS guidance in skills/generate-sandbox-policy/, which told agents tls: terminate was required for HTTPS plus L7, and warn there against substituting tls: skip for a rejected value.
• Docs: 0.1.0 migration entry, the new contract in policy-schema.mdx, the proto/sandbox.proto comment and regenerated Go binding, the accepted-values invariant in architecture/security-policy.md, and the quickstart README.

Upgrade impact

A stored policy carrying a removed value fails validation on read, so GetSandboxConfig returns FAILED_PRECONDITION. openshell policy list --global reports which revision is invalid and why, and policy set --global re-applies a corrected policy because it validates only the incoming one. policy delete --global does not recover, since it decodes the stored policy before removing the key; that is pre-existing and filed separately, so the migration note points at set.

The community sandbox images still ship tls: terminate in their baked /etc/openshell/policy.yaml, but RFC-0012 put the supervisor in its own container with no mount of the workload rootfs, so an image-baked policy is not read on any path. Cleaning those images is hygiene, not a prerequisite here.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[johntmyers]

gator-agent

PR Review Status

This accepted issue-backed policy cleanup is project-valid, and the migration and schema documentation are present. The initial code review found one blocking mismatch between the newly accepted TLS spelling and its runtime meaning.

Action required: please make validation and runtime parsing agree on whether case variants such as SKIP are accepted, and add regression coverage for the chosen contract.

Blocking findings:

• GATOR-deed4de9-01: validation accepts case variants that the runtime interprets differently

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: linked issue #3310 is accepted and this PR implements its policy-schema cleanup
• Docs: Fern policy reference and release migration notes are updated
• Checks: lightweight current-head checks and DCO are green; required full checks have not been dispatched
• E2E: required for policy enforcement and supervisor-network behavior, but deferred until the blocking finding is resolved
• Head SHA: deed4de95d0817c02652a3be7637e9e57d768ef5
• Base SHA: fc03bffead64f09c1f756a8eea6391ada999cf7a
• Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
• Patch ID: d326cd9bda107cfacd73d41104c06dcf166c7899
• Gator payload: 9
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied, but pull-request/3414 does not exist yet. A maintainer needs to comment /ok to test e6c28923b1b60f4fff67448c8154e578270b7e4e to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[johntmyers]

/ok to test e6c2892

[johntmyers]

gator-agent

PR Review Status

The follow-up review confirms that exact lowercase skip is now the only accepted opt-out spelling and that accepted values are checked against runtime parsing. The prior TLS-mode mismatch is resolved, with no new blocking findings in the author delta.

Blocking findings:

• No blocking findings remain

Carried findings:

• None; GATOR-deed4de9-01 is resolved

Gator metadata

• Validation: linked accepted issue #3310 covers this policy-schema cleanup
• Docs: Fern policy reference and release migration notes are updated
• Checks: current-head Branch Checks and Helm Lint are running
• E2E: test:e2e applied; current-head mirror created and Branch E2E Checks are running
• Head SHA: e6c28923b1b60f4fff67448c8154e578270b7e4e
• Base SHA: 50c5cf8ed0423f545fee7e0ccc7e7699eec9e290
• Merge base SHA: c502be9fd73c41bab25f0a88587b7a3d90c96b55
• Patch ID: 6e17746529cf8b656121f7e3c6902e0a34a442aa
• Gator payload: 9
• Review mode: follow_up
• Previous reviewed SHA: deed4de95d0817c02652a3be7637e9e57d768ef5
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[lunarwhite]

Looks all check passed/skipped, no inflight jobs running