fix(e2e): support distroless supervisor fixture

[pimlock]

Summary

Restore the Docker provider-readiness E2E after the supervisor image moved to a shell-free distroless base. The fixture now installs its synthetic CA with a Docker COPY instead of a shell-form RUN, and reports distinct labels for workload and supervisor fixture build failures.

Related Issue

No issue required: this is a localized compatibility fix for the interaction between #3391 and #3393.

Changes

• Replace the fixture CA bundle without invoking a shell in the derived supervisor image.
• Preserve the compiled Mozilla roots used by supervisor upstream TLS.
• Distinguish workload and supervisor image-build errors.

Testing

• mise run pre-commit passes
• Existing provider-readiness E2E passes against the distroless supervisor image
• Full mise run e2e:rust passes

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

Label test:e2e applied for 45bb948. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.