Track OpenShell v0.1.8 on openshell-next #80

Tracks OpenShell v0.1.8 on the openshell-next branch (draft PR into main linked below). Once #79 merges, .github/workflows/openshell-next.yml comments here for every new upstream tag.

Current pin on openshell-next: v0.1.8-pre.3 (53b8eec2). main stays on v0.1.7. Changes since v0.1.7

Result on v0.1.8-pre.3 (macOS, Rust 1.94): fmt, clippy -D warnings, cargo test --locked (incl. gateway_policies) and gen-docs.sh --check pass with no code changes. scripts/upstream-compat.sh latest-prerelease, with both crates repointed, is ✅ too.

Upstream changes to verify before promoting

• fix(sandbox): validate filesystem policy anchors NVIDIA/OpenShell#5278 (filesystem policy anchors). This is a runtime (Landlock) change in openshell-sandbox. The policy crates and our lint/generate are unaffected, and the tests pass. Check in a real v0.1.8 sandbox that generated filesystem_policy paths launch, because a symlink under a workload-writable dir now fails launch even in best_effort, and so does a policy with no usable paths. Consider a lint hint for symlinked paths.
• fix(network): align REST and WebSocket endpoint handling NVIDIA/OpenShell#5336 (REST vs WebSocket). The gateway validator now rejects websocket_credential_rewrite on protocol: rest, which we never emit. REST endpoints now answer Upgrade requests with 403, so code that opens WebSockets needs a protocol: websocket directive. Consider a lint warning when a WebSocket client call site is covered by a rest directive.
• feat(policy): lint authored policy files offline NVIDIA/OpenShell#5358 (offline policy lint). Still an open PR and in no tag. Compare it with our lint once it lands.
• RUSTSEC-2026-0459. libsqlite3-sys is still 0.37.0 on v0.1.8-pre.3 and on OpenShell main, so the .cargo/audit.toml ignore stays.
• Sandbox flow (playground, 16 cards) against an OpenShell v0.1.8 gateway/CLI.
• On the stable v0.1.8, follow docs/RELEASING.md "Promoting openshell-next when OpenShell ships stable".