ate-setup: allow overriding the bundled gVisor asset location #2649

Problem

The bundled gvisor-default SandboxConfig always references the public gs://gvisor/releases/ bucket.

Substrate can already fetch checksum-pinned assets from an internal GCS or S3-compatible object store. However, using that support requires operators to patch or replace gvisor-default after installation. A later ate-setup deploy ate-system reapplies the public URLs.

Creating a differently named SandboxConfig also requires ActorTemplates to reference that name, so existing manifests and demos no longer use the bundled default unchanged.

Proposal

Allow the installer to rewrite the asset base URL before applying gvisor-default, for example:

• sandbox.gvisorAssetBaseURL
• --gvisor-asset-base-url
• ATE_GVISOR_ASSET_BASE_URL

Given:

s3://substrate-assets/gvisor/releases/

the installer would replace only the gs://gvisor/releases/ prefix while preserving the release path and SHA-256 values.

Operators remain responsible for copying the pinned files into their object store. This request does not add another asset-fetch mechanism or staging tool; it only makes the existing internal-object-store support durable across installer runs.

Context

#1855 established that internal object stores are supported. #2439 ensures re-hosted assets are fetched through the object-store plugin. The remaining gap is configuring the bundled SandboxConfig through ate-setup.