Design checkpoint, pause, and resume support

[dhirajsb]

Motivation

Checkpoint, pause, and resume support would allow long-running or stateful OpenShell sessions to be suspended and restored more ergonomically. This is a larger feature and likely needs gateway/proto design before implementation.

Proposed design scope

Use this issue to agree on the design before implementation. The design should cover:

• What state is captured and what is explicitly out of scope.
• The Python SDK API for checkpoint, pause, and resume.
• Gateway/proto changes, if required.
• Security properties for serialized state.
• Failure modes and compatibility across OpenShell versions.

Acceptance criteria

• Produce a design proposal for checkpoint/pause/resume.
• Identify required gateway/proto changes.
• Define the Python SDK API shape.
• Document security considerations and restore failure modes.
• Split follow-up implementation issues if the design is accepted.

Notes

This is intentionally design-first because it likely crosses SDK, gateway, and protocol boundaries.

[drew]

This is something we should support, but first need to square away isolation primitives #1737 and finish some other big roadmap items such as #1012 and #873.

[github-actions]

This issue has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity. Comment or remove the state:stale label to keep it open.

[dhirajsb]

@NVIDIA/openshell-codeowners, since this has moved beyond initial triage and is recognized as a feature request, could you clarify what contribution is appropriate now?

Given the roadmap blockers noted above, would a design-only proposal be useful, or should I wait before opening any PR? If checkpoint/pause/resume is now tracked by another issue, RFC, or implementation, please point me to it.

My repository permission is currently READ, I am not listed in .github/VOUCHED.td, and I do not have a vouch-request discussion. Does my NVIDIA organization membership qualify for the contributor bypass, or should I complete the vouch process first?