RDP desktops through the gateway into AIWG Cockpit

The integration plan is maintained in the private AIWG artifact corpus: planning package.

Delivery epic #852 links Sandbox admission/lifecycle/credential/adapter issues #853–#856, AIWG Cockpit identity/Bridge/UI issues #2545–#2547, and itops deployment #825. The package contains research, three proposed ADRs, seven use cases, an architecture/API contract, threat model, test plan and dependency traceability.

The proposed path is Cockpit → authenticated Bridge → Sandbox desktop broker and private display worker → restricted gateway SSH forwarding → guest-loopback xrdp/XFCE. Guacamole is the preferred RDP comparison candidate, pending the existing #842 experiment and #843 readiness gate.

This is a reviewed plan, not implemented browser RDP. The image audit records narrower XFCE image smoke evidence. Shared-user authorization, authenticated RDP, active revocation and full Cockpit qualification remain implementation acceptance gates.