Rename all 9 Rust crates from navigator-* to openshell-* to align
with the project rename to OpenShell. This is a comprehensive rename
touching ~1400 references across ~220 files:
- Crate directories and Cargo.toml names/deps
- Proto files (navigator.proto -> openshell.proto), packages, service name
- All Rust source imports (navigator_ -> openshell_) and string literals
- OPA Rego policy package name
- Python proto files and all SDK/e2e imports
- Dockerfiles, CI workflows, build scripts, task files
- Agent skills, documentation, and agent memory files
- Filesystem paths, CLI flags, K8s resource names, TLS cert subjects,
HTTP headers, gRPC paths
Binary names updated: navigator-server -> openshell-server,
navigator-sandbox -> openshell-sandbox (CLI was already openshell).
The S3 bucket navigator-pypi-artifacts is flagged with a TODO comment
as it requires external coordination to rename.
Closes#48, #52
## Summary
- Replace the envoy-gateway-based TLS setup with inline PKI generation during cluster bootstrap, generating CA, server, and client certificates directly in the `navigator-bootstrap` crate
- Remove all envoy gateway Helm templates (`gateway.yaml`, `gatewayclass.yaml`, `grpcroute.yaml`, PKI job, traffic policies) and the `Dockerfile.pki-job`
- Add native mTLS support to the navigator server with `tokio-rustls`, mounting client TLS certs as volumes into sandbox pods
- Update cluster entrypoint, healthcheck, and deploy scripts to work with the new direct-TLS architecture
- Add TLS security e2e test and fix formatting/clippy warnings
## Test Plan
- All unit tests pass (`cargo test --workspace`)
- Clippy clean (`cargo clippy --workspace --all-targets`)
- Format clean (`cargo fmt --all -- --check`)
- Python tests pass (`uv run pytest python/`)
- Full `mise run pre-commit` passes
Drew Newberry