feat(gateway): explain compute driver discovery decisions

調査で説明されている共有ローカル API ソケット検出パスから開始します。このパスでは、Unix ソケットに対する HTTP プローブの失敗が利用不可の結果にまとめられます。メタデータ、接続、書き込み、読み取り、タイムアウト、レスポンス検証の各パスを追跡し、続いて、成功、未存在、権限拒否を表す結果を使って、候補ごとの診断、簡潔な起動時サマリー、安全なエンドポイント報告を検証します。

User Story

As an OpenShell operator, I want the gateway to explain how it selected or rejected local compute drivers, so that I can diagnose startup failures without reproducing them under a debugger.

Problem Statement

Gateway auto-detection probes local driver candidates, such as Docker Unix sockets, but silently treats probe failures as unavailable. When a candidate socket exists but Snap confinement denies access, the gateway eventually reports only that no suitable driver was found and systemd may restart it. Operators cannot tell which candidates were examined, whether a driver was selected, or whether a candidate failed because of a missing socket, an access denial, a timeout, or an unexpected API response.

Impact / Why This Matters

Package and confinement failures are difficult to distinguish from an absent runtime. The current workaround is to manually inspect socket paths, Snap interface connections, and journal output, then infer the cause. That is insufficient for CI and user installations because the decisive probe result is not recorded.

Proposed Design

When gateway driver auto-detection runs, expose diagnostics at debug level that identify each candidate driver and socket probe outcome without logging credentials or other sensitive data. Startup errors should provide a concise summary of the attempted drivers and why no usable driver was selected. A successful selection should state the selected driver and endpoint category in diagnostics.

Acceptance Criteria

• With debug logging enabled, each local compute-driver candidate records whether it was selected, skipped, or rejected.
• Docker socket diagnostics distinguish a missing/non-socket path, connection denial, timeout, and an incompatible or unsuccessful API response.
• Normal startup errors summarize the failed discovery decision without exposing secrets or request contents.
• A successful auto-detection records the selected driver and does not expose sensitive endpoint data.
• Coverage verifies representative successful, missing, and permission-denied probe outcomes.

Alternatives Considered

• Relying only on systemd or Snap logs: these do not report the gateway discovery decision or every candidate it attempted.
• Treating socket existence as availability: this would hide confinement failures and select unusable drivers.
• Requiring an explicitly configured driver: useful as a workaround, but does not make default installations diagnosable.

Agent Investigation

Docker discovery currently probes each candidate with a Unix-socket HTTP ping and returns only a boolean result. Failed metadata, connect, write, read, timeout, and response-validation paths are intentionally collapsed into unavailable. This behavior is shared by local API socket discovery and leaves no per-candidate diagnostic trail.

Related: https://github.com/NVIDIA/OpenShell/pull/2869#discussion_r3928619578