fix(ci): run e2e as a single local job without GHCR push

Restructure branch e2e from three separate jobs (build-gateway, build-
cluster, e2e) that push images to GHCR into a single job that builds
and tests locally. This eliminates the GHCR write permission requirement
that blocked fork PRs.

The build scripts already default to --load (no push) for single-
platform builds, and 'mise run e2e' orchestrates the full pipeline:
build images locally, start a local registry, boot the cluster, and
run tests. No workflow_call changes needed.

Permissions reduced from packages: write to packages: read (only needed
to pull the CI container image).

Author: johntmyers

.github/workflows/branch-e2e.yml

@@ -6,28 +6,36 @@ on:
 
 permissions:
   contents: read
-  packages: write
+  packages: read
 
 jobs:
-  build-gateway:
+  e2e:
     if: contains(github.event.pull_request.labels.*.name, 'test:e2e')
-    uses: ./.github/workflows/docker-build.yml
-    with:
-      component: gateway
-      platform: linux/arm64
-      runner: build-arm64
+    name: E2E
+    runs-on: build-arm64
+    timeout-minutes: 45
+    container:
+      image: ghcr.io/nvidia/openshell/ci:latest
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+      options: --privileged
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+    env:
+      MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Single platform so buildx uses --load (no registry push needed).
+      DOCKER_PLATFORM: linux/arm64
+      EXTRA_CARGO_FEATURES: openshell-core/dev-settings
+    steps:
+      - uses: actions/checkout@v4
 
-  build-cluster:
-    if: contains(github.event.pull_request.labels.*.name, 'test:e2e')
-    uses: ./.github/workflows/docker-build.yml
-    with:
-      component: cluster
-      platform: linux/arm64
-      runner: build-arm64
+      - name: Install tools
+        run: mise install
 
-  e2e:
-    needs: [build-gateway, build-cluster]
-    uses: ./.github/workflows/e2e-test.yml
-    with:
-      image-tag: ${{ github.sha }}
-      runner: build-arm64
+      - name: Install SSH client
+        run: apt-get update && apt-get install -y --no-install-recommends openssh-client && rm -rf /var/lib/apt/lists/*
+
+      - name: Run E2E tests
+        run: |
+          mise run e2e