chore(gateway)!: remove the deprecated Podman CA bundle alias in 0.2.0 #5172

User Story

The v0.1.7 compatibility review requires preserving existing Podman gateway configurations for a patch upgrade. The release-maintenance follow-up is to retire that compatibility alias in OpenShell 0.2.0, when operators can migrate to the shared supervisor network setting.

Description

Remove support for the deprecated gateway TOML key [openshell.drivers.podman].additional_ca_bundle in 0.2.0. Keep [openshell.supervisor.network].additional_ca_bundle as the supported destination CA configuration.

This is an intentional configuration compatibility break for the 0.2.0 release, not a change to the shared CA validation, staging, or trust behavior.

Context

• feat(network): support additional destination CAs #3292 moved additional destination CAs to shared supervisor network configuration.
• bug(gateway): preserve the legacy Podman additional CA bundle setting #5154 tracks restoring the old Podman key as a deprecated alias for patch-release compatibility.
• fix(gateway): preserve the legacy Podman CA bundle setting #5155 implements that alias and migration warning.
• Removal should ship with OpenShell 0.2.0, after the compatibility fix.

Suggested UX

Operators migrate from:

[openshell.drivers.podman]
additional_ca_bundle = "/etc/openshell/certs/private-destination-ca.pem"

to:

[openshell.supervisor.network]
additional_ca_bundle = "/etc/openshell/certs/private-destination-ca.pem"

After removal, the old key must fail clearly and direct operators to the supported setting rather than silently discarding configured trust.

Definition of Done

• Remove the legacy gateway TOML alias, its normalization bookkeeping, and its deprecation warning.
• Retain shared supervisor destination CA configuration and validation/staging behavior.
• Add regression coverage showing the old key is rejected with migration guidance and the supported key still works.
• Document the configuration migration in the 0.2.0 release notes and relevant gateway configuration guidance.
• Keep standalone Podman driver CLI/environment settings outside this removal's scope.