refactor(cli): remove local Dockerfile image builds

.agents/skills/launch-openshell-gator/SKILL.md

@@ -26,7 +26,7 @@ For gator's PR/issue validation policy, load `gator-gate` inside the launched sa
 |---|---|
 | `scripts/agents/run.sh` | Manifest-driven OpenShell agent launcher. |
 | `scripts/agents/gator/agent.yaml` | Gator manifest: immutable payload version, default gateway, harness, providers, runtime, skills, and subagents. |
-| `scripts/agents/gator/Dockerfile` | Gator sandbox image source. Local launches build this image through OpenShell. |
+| `scripts/agents/gator/Dockerfile` | Gator sandbox image source. Local launches build it in gateway's Docker or Podman image store. |
 | `scripts/agents/gator/policy.yaml` | Sandbox policy for the gator agent. |
 | `scripts/agents/gator/bin/gh` | Gator-specific `gh` wrapper and same-SHA duplicate-post guard. |
 | `scripts/agents/gator/bin/review-feedback-ledger` | Builds tree-aware review scope, durable findings, convergence telemetry, and review-budget state. |
@@ -160,7 +160,7 @@ sandbox_name="gator-pr-${pr_number}-supervised"
   "Review and monitor PR #${pr_number} through the gator-gate workflow. Scope this invocation only to PR #${pr_number}."
 ```
 
-The launcher builds the gator sandbox image when needed, stages the immutable payload, imports provider profiles, configures provider credentials and refresh, creates and uploads the sandbox payload, then starts the agent supervisor with `sandbox exec`. It writes a background log under `scripts/agents/gator/logs/`.
+The launcher queries gateway's selected compute driver, builds gator image in matching Docker or Podman image store, stages immutable payload, imports provider profiles, configures provider credentials and refresh, creates and uploads sandbox payload, then starts agent supervisor with `sandbox exec`. It writes a background log under `scripts/agents/gator/logs/`. `CONTAINER_ENGINE`, when set, must match gateway driver.
 
 ### Launch An Issue Or Issue/PR Pair
 

README.md

@@ -196,14 +196,20 @@ The TUI gives you a live, keyboard-driven view of your gateway and sandboxes. Na
 
 ## Community Sandboxes and BYOC
 
-Use `--from` to create sandboxes from the [OpenShell Community](https://github.com/NVIDIA/OpenShell-Community) catalog, a local directory, or a container image:
+Use `--from` to create sandboxes from the [OpenShell Community](https://github.com/NVIDIA/OpenShell-Community) catalog or a container image:
 
 ```bash
 openshell sandbox create --from gemini             # community catalog
-openshell sandbox create --from ./my-sandbox-dir   # local Dockerfile
+docker build -t my-sandbox:latest ./my-sandbox-dir # Docker gateway
+openshell sandbox create --from my-sandbox:latest  # Docker built image
+podman build -t localhost/my-sandbox:latest ./my-sandbox-dir # Podman gateway
+openshell sandbox create --from localhost/my-sandbox:latest  # Podman built image
 openshell sandbox create --from registry.io/img:v1 # container image
 ```
 
+Build with the container engine used by your local gateway. For a remote
+gateway, push the image to a registry that the gateway can pull from.
+
 See the [OpenShell Community](https://github.com/NVIDIA/OpenShell-Community) catalog and the [BYOC example](https://github.com/NVIDIA/OpenShell/tree/main/examples/bring-your-own-container) for details.
 
 ## Use OpenShell with Your Agent

crates/openshell-bootstrap/Cargo.toml

@@ -12,20 +12,15 @@ rust-version.workspace = true
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false }
 bytes = { workspace = true }
-futures = { workspace = true }
 miette = { workspace = true }
 rcgen = { workspace = true }
 sha2 = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tar = "0.4"
 tempfile = "3"
 tokio = { workspace = true }
 tracing = { workspace = true }
 
-[target.'cfg(not(target_os = "windows"))'.dependencies]
-bollard = "0.20"
-
 [dev-dependencies]
 
 [lints]