bug(examples): podman token-exchange demo fails to start gateway with documented default image

Start with examples/spiffe-token-exchange-demo/podman/README.md and podman/start-gateway.sh, then reproduce the failure using the documented demo.sh command and inspect the gateway logs. Determine which compatibility approach maintainers want, and consider the demo complete when the default setup starts the gateway successfully with the documented image and schema.

What happens

Following examples/spiffe-token-exchange-demo/podman/README.md on main, the gateway container exits immediately:

unknown field `compute_driver`, expected one of `name`, `bind_address`,
`health_bind_address`, `metrics_bind_address`, `log_level`,
`compute_drivers`, `credential_drivers`, ...

Why

podman/start-gateway.sh:141 writes the schema v2 scalar:

compute_driver = "podman"

The README's default GATEWAY_IMAGE=ghcr.io/nvidia/openshell/gateway:latest currently resolves to an image built 2026-08-28 (matching the v0.0.116 release), which predates schema v2 and still expects the plural compute_drivers.

Schema v2 landed in 02b664bb ("refactor(config): normalize and enforce gateway schema v2", #2814) on 2026-09-11. So main's demo script and the documented default image are a release apart, and anyone following the README with default settings gets a gateway that will not start.

Note that start-gateway.sh on main still writes the singular form, so this is not a case of the script lagging: the script is correct for main and the default image is stale relative to it.

Reproduce

export OPENSHELL_REPO=/path/to/OpenShell
START_GATEWAY=1 bash "$OPENSHELL_REPO/examples/spiffe-token-exchange-demo/podman/demo.sh"
podman logs openshell-spiffe-demo-gateway

Possible fixes

Any one of these resolves it:

• Pin GATEWAY_IMAGE in the demo to a commit-tagged image matching the checkout. Commit-tagged images do exist (for example ghcr.io/nvidia/openshell/gateway:02b664bb0d978ac0baec9aaa0bf06a2a4f67e83d), and pinning also makes the demo reproducible over time.
• Have start-gateway.sh emit the schema the target image expects.
• Publish a :latest that tracks main, so the README default matches the checkout.

Environment

Verified on macOS 15 (Darwin 25.6.0) with Podman 6.1.1 against a Fedora CoreOS 44 machine VM, but the schema mismatch is platform independent.