refactor(compute): move driver-specifics into a dedicated crate

[elezar]

Description

Move driver-specific compute wiring out of openshell-server into a dedicated crate, tentatively openshell-compute-driver.

Context

Follow-up to #1949, but intentionally broader than the current PR. The current branch normalizes selected-driver startup behavior inside openshell-server; this issue tracks a later boundary cleanup so server code no longer owns built-in driver-specific details.

Candidate scope:

• Move selected driver config loading, inheritance, and runtime defaulting out of openshell-server.
• Move VM subprocess/socket launcher plumbing out of openshell-server.
• Hide Docker, Podman, Kubernetes, and VM-specific constructor wiring behind a shared crate boundary.
• Keep ComputeRuntime and sandbox persistence/reconciliation in openshell-server.
• Preserve selected-driver-only validation and existing local TLS/defaulting behavior.

Definition of Done

• Add a dedicated crate for built-in compute-driver wiring.
• Remove direct built-in driver construction from openshell-server.
• Keep server lifecycle/persistence behavior unchanged.
• Update config and startup tests to cover the new boundary.
• Update architecture docs if crate ownership changes are visible to maintainers.