fix: keep shared supervisor runtime credential files in memory #4851

User Story

I am deploying OpenShell's shared Kubernetes supervisor and want its per-instance runtime credential files kept in memory instead of on node-backed storage.

Problem Statement

The shared supervisor writes per-instance proxy CA certificates and private keys beneath /run/openshell/sessions. The Helm chart currently mounts /run/openshell using emptyDir: {}, which is ephemeral but normally backed by the node filesystem.

Impact / Why This Matters

Per-instance private keys should use memory-backed runtime storage. Pod-local lifetime alone does not make the current volume memory-backed.

Proposed Design

Deploy the shared supervisor with a memory-backed runtime volume. Keep the existing instance file permissions and cleanup behavior. Durable launch Secrets used to reconstruct assignments after gateway restarts remain separate and unchanged.

Acceptance Criteria

• The shared supervisor's /run/openshell mount uses an emptyDir with medium: Memory.
• Existing chart verification protects the memory-backed runtime volume.
• Deployment guidance identifies the memory-backed storage and its container memory accounting.
• Dedicated supervisor placement and durable launch recovery remain unchanged.

Alternatives Considered

Passing proxy CA material directly as in-memory values would remove the file interface, but requires a broader runtime refactor. A memory-backed runtime volume satisfies this deployment requirement while preserving the existing interfaces and cleanup.

Context

Follow-up to #4702, currently queued for merge.