ci: add Fedora conformance workflow

[SDAChess]

Summary

Add an initial Fedora conformance workflow that builds the OpenShell RPMs from the PR commit, installs them in a disposable Fedora guest, and verifies the local gateway with openshell status.

Related Issue

No issue required: this is an initial CI proof of concept for the RFC 014 conformance pipeline.

Changes

• Add a Conformance workflow for PR mirror branches and manual dispatches
• Reuse the existing CLI, gateway, and RPM build workflows
• Boot a disposable Fedora guest with rootless Podman and enforcing SELinux
• Install the generated openshell and openshell-gateway RPMs
• Start and register the package-managed gateway
• Run openshell status
• Print gateway, Podman, and SELinux diagnostics when the guest check fails

Testing

• nix run nixpkgs#actionlint -- .github/workflows/conformance.yml
• git diff --check
• mise run pre-commit — not run
• GitHub Actions conformance run — pending PR creation
• Unit tests are not applicable to this workflow-only change

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[SDAChess]

Closes #2973

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[SDAChess]

/ok-to-test 32a43a6

[SDAChess]

/ok-to-test afc6202

[elezar]

I have some non-blocking questions / comments that can be addressed as follow-ups.

The other one would be whether it makes sense to rework / clean up the commit history, but since we squash on merge anyway, that should be fine.