docs(config): describe push delivery as applied, not shadow-only

Stage 2 lets supervisors apply streamed configuration, so the config enum, field, and --config-delivery-mode help no longer describe push as a shadow-only stream.

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

Author: pimlock

crates/openshell-core/src/config.rs

@@ -47,7 +47,10 @@ pub const DEFAULT_DOCKER_NETWORK_NAME: &str = "openshell-docker";
 pub const DEFAULT_SERVICE_ROUTING_DOMAIN: &str = "openshell.localhost";
 
 /// Gateway delivery path for supervisor configuration.
-/// `Push` is a shadow stream until supervisors support applying snapshots.
+///
+/// `Push` sends configuration over the supervisor session. Supervisors that
+/// apply streamed configuration stop polling; others keep polling and treat the
+/// stream as a shadow.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum ConfigDeliveryMode {
@@ -233,7 +236,7 @@ pub struct Config {
     /// Security posture for rejected sandbox policy generations.
     pub policy_validation_failure_mode: PolicyValidationFailureMode,
 
-    /// Optional shadow push of complete supervisor configuration snapshots.
+    /// Whether supervisors poll for configuration or receive it over their session.
     pub config_delivery_mode: ConfigDeliveryMode,
 
     /// TLS configuration.  When `None`, the server listens on plaintext HTTP.

crates/openshell-server/src/cli.rs

@@ -239,7 +239,7 @@ struct RunArgs {
     #[arg(long, env = "OPENSHELL_GRPC_RATE_LIMIT_WINDOW_SECONDS")]
     grpc_rate_limit_window_seconds: Option<u64>,
 
-    /// Supervisor configuration delivery. Push sends shadow snapshots in this release.
+    /// Supervisor configuration delivery: poll (default) or push over the supervisor session.
     #[arg(long, env = "OPENSHELL_CONFIG_DELIVERY_MODE")]
     config_delivery_mode: Option<ConfigDeliveryMode>,