refactor(sdk): pass gateway settings through gatewayConfig, not legacy server values

[cv]

Failure

The OpenShell v0.1.3 chart (NVIDIA/OpenShell#3384) moves gateway settings into gatewayConfig. NemoClaw still set four of them through server.* values, which work only through the chart's compatibility mapping:

• server.oidc issuer, audience, claims, and roles
• server.auth.allowUnauthenticatedUsers
• server.workspaceDefaultStorageSize
• server.drivers.kubernetes.workspaceMode

Decision

Set them in gatewayConfig (schema version 2), using the dotted TOML table keys the chart's own CI values use:

gatewayConfig:
  openshell.gateway.oidc:        # issuer, audience, jwks_ttl_secs, roles_claim,
                                 # admin_role, user_role, scopes_claim,
                                 # dangerously_allow_insecure_http
  openshell.gateway.auth:
    allow_unauthenticated_users: false
  openshell.drivers.kubernetes:
    workspace_mode: shared
    workspace_default_storage_size: 2Gi

server keeps only values the templates read directly: TLS, the JWT signing secret, credential storage, telemetry, and server.oidc.caConfigMapName. The chart mounts the issuer CA only from that last value. The settings themselves are unchanged.

Validation

• The gateway value tests now require the gatewayConfig tables, and that server holds only those directly read keys. Both failed before the change and pass after it. All 84 Kubernetes tests pass.
• cargo ci passed: 1,322 workspace tests and all 120 lifecycle tests.
• Live / Kind passed on linux_arm64 and linux_amd64 with the real v0.1.3 chart (run 38003924177). That includes the_pinned_chart_renders_with_the_sdk_values and the_gateway_installs_authenticates_and_is_removed_keeping_storage, which authenticates through the OIDC settings in gatewayConfig.

[github-actions]

v1 documentation preview: https://nvidia-preview-nemoclaw-v1-pr-12949.docs.buildwithfern.com/nemoclaw