feat(providers): enable providers v2 by default #2545

Problem Statement

Providers v2 is currently behind an opt-in settings flag (providers_v2_enabled). Developers must run openshell settings set --global --key providers_v2_enabled --value true before custom profiles, policy composition, and the full credential lifecycle are available.

This means the entire providers v2 capability surface — custom profile import, request body credential rewrite, WebSocket credential rewrite, provider-derived policy layers — is invisible to developers who don't know the flag exists.

As a result, developers fall back to passing raw credentials as --env variables, exposing them to the agent inside the sandbox.

Proposed Design

Remove the providers_v2_enabled settings gate. Providers v2 becomes the default behavior for all gateways.

• Legacy credential-only provider behavior remains available via explicit opt-out: openshell settings set --global --key providers_v2_enabled --value false
• Existing --type nvidia, --type github etc. workflows work identically under v2 — it is a superset of v1
• The flag removal is a behavior change for gateways that have not opted in. Migration docs should cover what changes.

Motivation

A recent demo (opendatahub-io/agent-ops#7) passed Jira, MLflow, and GCP credentials as raw env vars because the developer did not know providers v2 existed. The secure credential-hiding path was available but invisible behind the settings gate.

Making providers v2 the default is the single highest-impact change to shift developers from the insecure path to the secure path.

Agent Investigation

• providers_v2_enabled gate checked in crates/openshell-server/
• Settings examples in CLI help text reference the flag: crates/openshell-cli/src/main.rs:370
• All providers v2 capabilities (custom profiles, policy composition, credential lifecycle) are production-tested and available since v0.0.85
• Providers v2 documentation exists at https://docs.nvidia.com/openshell/latest/sandboxes/providers-v2

Checklist

• Searched for existing issues — no issue tracks making v2 the default
• This is a design proposal with migration considerations