fix(network): reconcile additional CA tests with suspend/resume and auth changes

Upstream's suspend/resume lifecycle took StartSandboxRequest fields 7
and 8, so the durable-snapshot field moves from 7 to 9; update the
wire-format test to assert the field-9 key (0x4a) and initialize the
new resume controls. Repair the cli test module after the auth opt-in
test merged alongside the environment-guard helpers, and initialize the
gateway driver-startup context's network-trust fields in the shared
supervision test.

Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>

Author: jhjaggars

crates/openshell-server/src/cli.rs

@@ -1573,6 +1573,8 @@ mod tests {
                         assert!(error.contains(expected), "missing {expected:?} in {error}");
                     }
                 });
+        }
+    }
 
     static ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
 

crates/openshell-server/src/compute/mod.rs

@@ -18128,14 +18128,16 @@ endpoint = { kind = "unix", socket_path = "/run/agent-substrate/isolation.sock"
     }
 
     #[test]
-    fn start_sandbox_request_uses_optional_wire_field_seven_for_durable_snapshot() {
+    fn start_sandbox_request_uses_optional_wire_field_nine_for_durable_snapshot() {
         let legacy = StartSandboxRequest {
             sandbox_id: "sandbox-id".into(),
             name: "sandbox-name".into(),
             launch_authentication: b"opaque-auth".to_vec(),
             generation_id: "generation-id".into(),
             expected_runtime_identity: String::new(),
             isolation_backend: None,
+            resume: false,
+            restart_if_restore_fails: false,
             sandbox: None,
         };
         let with_snapshot = StartSandboxRequest {
@@ -18148,11 +18150,11 @@ endpoint = { kind = "unix", socket_path = "/run/agent-substrate/isolation.sock"
         };
         let legacy_wire = legacy.encode_to_vec();
         let snapshot_wire = with_snapshot.encode_to_vec();
-        // Field 7 is length-delimited, hence its protobuf key is 0x3a. The
-        // legacy form does not emit it, preserving existing fields 1–6
-        // (field 6 is the upstream isolation backend registration).
-        assert!(!legacy_wire.contains(&0x3a));
-        assert!(snapshot_wire.contains(&0x3a));
+        // Field 9 is length-delimited, hence its protobuf key is 0x4a. The
+        // legacy form does not emit it, preserving existing fields 1–8
+        // (fields 7 and 8 are the upstream suspend/resume controls).
+        assert!(!legacy_wire.contains(&0x4a));
+        assert!(snapshot_wire.contains(&0x4a));
         assert_eq!(
             StartSandboxRequest::decode(snapshot_wire.as_slice())
                 .unwrap()

crates/openshell-server/src/lib.rs

@@ -2426,6 +2426,8 @@ mod tests {
                         guest_tls: None,
                         gateway_port: 8080,
                         gateway_tls_enabled: true,
+                        network_trust: None,
+                        network_trust_configured: false,
                         endpoint_overrides: &endpoint_overrides,
                     },
                 },