feat: package OpenShell for Fedora

Start with the root-level openshell.spec and the listed child issues, especially #1969, #2204, and #3454; inspect the current source, vendor inputs, and Fedora build constraints. Done means the package builds from source with rpmbuild/mock without network access after %prep, has documented dependency and license handling, and passes Fedora Rawhide and package-review requirements.

User Story

As a Red Hat engineer helping productize OpenShell for internal RPM/entitlement use, and as an OpenShell contributor, I want OpenShell available as a properly reviewed Fedora package, so Fedora users and downstream consumers can install it through their normal package manager instead of install scripts or third-party COPR repos.

Problem Statement

OpenShell has no path into Fedora today. The repo carries a root-level openshell.spec intended for Fedora/EPEL, but it isn't build-ready — it consumes externally prebuilt binaries rather than compiling from source, which Koji/mock cannot support. Getting into Fedora also requires resolving vendored-dependency policy questions (~600 vendored Rust crates), a bundled library with a system equivalent (Z3), and a vendored crypto stack that bypasses system crypto policy.

Impact / Why This Matters

Several Red Hat product efforts want a supported, source-buildable path to OpenShell RPMs; Fedora-first is one of two distribution paths being evaluated internally, and landing in Fedora is more durable and community-aligned than an internal-only channel. Today the only RPM path is a hand-rolled internal COPR build — not Fedora-reviewed, not broadly redistributable.

Proposed Design

Track the concrete engineering work as linked child issues, work through them roughly in dependency order, then proceed through Fedora's package review process once the spec is review-ready.

Acceptance Criteria

• openshell.spec builds via rpmbuild/mock from source with no network access after %prep
• Vendored dependencies are license-audited and correctly reflected in License:
• Z3 and vendored-crypto bundling concerns are resolved or explicitly documented
• A package review request is filed and approved via Fedora's New Package Process
• OpenShell builds successfully in Fedora Rawhide

Alternatives Considered

• Internal-only RPM distribution (via an internal COPR/entitlement channel) — already in progress in parallel by a separate internal team; faster to a shippable artifact but doesn't benefit the broader Fedora/community ecosystem and adds a second packaging surface to maintain long-term.
• Container-image-only distribution (status quo) — doesn't meet the needs of consumers who want a system-package-manager-installable binary.

Child Issues

• Fix %build to compile from source instead of consuming prebuilt binaries
• Generate Python protobuf stubs during the build
• Write a script to reproducibly generate Source0/Source1 (source + vendor tarballs)
• Fix the version/Release scheme
• Aggregate vendored-crate licenses into a real SPDX License: tag
• Resolve Z3 bundling — #1969
• Document the vendored-crypto (aws-lc-rs/rustls/ring) bundling justification
• Add a CI job that actually builds/validates the spec

Related: #1969, #2204, #3454

Checklist

• I've reviewed existing issues and the architecture docs
• This is a design proposal, not a "please build this" request