test(conformance): add canonical main and environment capabilities

[elezar]

Summary

Stacked on #3768, extend the leaf-scenario conformance set with canonical-main workload-result and declared-environment coverage. Remove only the Rust E2E cases superseded by those portable capabilities.

Related Issue

Depends on #3768.

No issue required: this is internal conformance and E2E test maintenance with no production behavior changes.

Changes

• Add sandbox-lifecycle/canonical-main coverage for successful, nonzero, and immediate canonical-main exits, including persistent terminal status and exit codes.
• Add sandbox-environment/declared coverage for declared environment propagation to canonical-main and exec processes.
• Register both leaves with the standalone runner and Cargo suite wrappers, including family-selector tests.
• Remove the superseded detached canonical-main and no-TTY declared-environment E2E tests.
• Keep attached-terminal output, CLI exit-code propagation, TTY environment, attachment/recovery, restart-policy, signal, and no-keep assertions in Rust E2E.
• Update the suite documentation and Podman artifact exclusions for the migrated coverage.

POSIX-independent lifecycle fixtures remain out of scope for this PR.

Testing

• mise run pre-commit (local sccache: Operation not permitted failure in lockfile validation; completed checks and focused commands below pass)
• cargo test -p openshell-conformance (18 passed)
• cargo test -p openshell-conformance-cli (8 passed)
• cargo test --manifest-path tests/suites/conformance/Cargo.toml --no-run
• Lifecycle E2E test compiles with the e2e feature
• Conformance and lifecycle E2E Clippy checks pass with warnings denied
• cargo fmt --all -- --check
• Live gateway conformance run (not run locally)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; test organization only)