M3.16: read substrate_actor_template from public-API annotations path

The driver's template_name_from_spec previously only checked
platform_config["substrate_actor_template"] at the top level. That key
is reachable from in-process callers (and tests/live.rs), but the
public OpenShell.v1.OpenShell.CreateSandbox path has no surface for
it: the gateway's build_platform_config (compute/mod.rs:1333) maps
SandboxTemplate.annotations into platform_config["annotations"] (a
nested Struct), runtime_class_name into a top-level key,
volume_claim_templates into another, etc. — none of which leave room
to inject a substrate-specific opaque value at the top.

This makes the driver's pre-provisioned-template path inaccessible to
gateway-shaped clients, which is exactly the path the helpdesk demo
needs (the synthesis path hardcodes a sleep loop as the child
workload, incompatible with running a Python helpdesk agent).

Extend template_name_from_spec to also look at
  platform_config["annotations"]["substrate_actor_template"]
so public-API callers can request a pre-provisioned template via:
  SandboxTemplate.annotations["substrate_actor_template"] = "helpdesk-agent"
The top-level key remains the primary path (driver-internal callers
preserve compatibility); the annotation fallback is checked only when
the top-level key is absent.

Signed-off-by: Davanum Srinivas <dsrinivas@nvidia.com>

Author: dims

crates/openshell-driver-substrate/src/lib.rs

@@ -666,18 +666,44 @@ fn require_sandbox_id(sandbox_id: &str, sandbox_name: &str) -> Result<String, St
 }
 
 /// Extract the Substrate ActorTemplate name from the sandbox's
-/// driver-specific configuration. The gateway carries this through
-/// `spec.template.platform_config` as a `google.protobuf.Struct`; we
-/// look for the well-known key `substrate_actor_template`. Returns
-/// `None` if either the path is missing or the value is not a string.
+/// driver-specific configuration. Two paths are checked, in order:
+///
+///  1. Top-level `platform_config["substrate_actor_template"]`. Used by
+///     in-process callers that build a `DriverSandbox` directly (and
+///     by the live integration test).
+///  2. `platform_config["annotations"]["substrate_actor_template"]`.
+///     The gateway's `build_platform_config` (compute/mod.rs:1333)
+///     nests `SandboxTemplate.annotations` under this key, so public
+///     OpenShell API callers can request a pre-provisioned template
+///     by setting `SandboxTemplate.annotations["substrate_actor_template"]`
+///     in their `CreateSandbox` request.
+///
+/// Returns `None` if neither path is present or the value is not a
+/// non-empty string.
 fn template_name_from_spec(sandbox: &DriverSandbox) -> Option<String> {
     use prost_types::value::Kind;
     let cfg = sandbox.spec.as_ref()?.template.as_ref()?.platform_config.as_ref()?;
-    let value = cfg.fields.get("substrate_actor_template")?;
-    match &value.kind {
-        Some(Kind::StringValue(s)) if !s.is_empty() => Some(s.clone()),
-        _ => None,
+    // 1. Top-level key (driver-internal callers).
+    if let Some(val) = cfg.fields.get("substrate_actor_template") {
+        if let Some(Kind::StringValue(s)) = &val.kind {
+            if !s.is_empty() {
+                return Some(s.clone());
+            }
+        }
+    }
+    // 2. Nested under `annotations` (public-API gateway-translated path).
+    if let Some(annotations_val) = cfg.fields.get("annotations") {
+        if let Some(Kind::StructValue(annotations)) = &annotations_val.kind {
+            if let Some(val) = annotations.fields.get("substrate_actor_template") {
+                if let Some(Kind::StringValue(s)) = &val.kind {
+                    if !s.is_empty() {
+                        return Some(s.clone());
+                    }
+                }
+            }
+        }
     }
+    None
 }
 
 /// Capability set the OpenShell supervisor needs to run in its full