docs: document OPENSHELL_SSH_HANDSHAKE_SECRET in Getting Started

[russellb]

Summary

Add OPENSHELL_SSH_HANDSHAKE_SECRET to the Getting Started section in CONTRIBUTING.md. The Podman and Kubernetes compute drivers require this variable, but it was never documented in the dev setup instructions. Developers using Podman (the default when it's installed) hit an opaque configuration error on first run.

Related Issue

Introduced by 2e0afea ("feat(vm): derive guest rootfs from sandbox images (#957)"), which added the requirement but exempted only Docker and VM drivers.

Changes

• Added an export OPENSHELL_SSH_HANDSHAKE_SECRET=dev-secret step to the Getting Started code block in CONTRIBUTING.md
• Included a comment explaining which drivers require the variable

Testing

• mise run pre-commit passes (pre-existing python:proto failure on main, unrelated)
• Unit tests added/updated (N/A — docs only)
• E2E tests added/updated (N/A — docs only)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[russellb]

I have read the DCO document and I hereby sign the DCO.

[TaylorMutch]

Hey @russellb - I was actually looking at removing the handshake altogether; we already have some auth guarantees with mTLS from the supervisor to gateways and we don't use it from the client to the gateways (I have a draft PR in flight for this, see #1274). It was originally needed when gateways initiated traffic to the supervisors, but as of 0.0.37 the traffic is switched (supervisors connect to the gateways) and we push the ssh traffic from the client to the sandbox over the grpc connection. So its original purpose is no longer needed.

So we may not need to document this going forward. Wdyt?

[maxamillion]

+1 good catch, thank you!