feat(sandbox): honor OCI image user identity

[matthewgrossman]

Summary

Run Docker and Podman agent processes as the non-root identity declared by the final OCI image while keeping the supervisor privileged. Resolve and persist that identity before exposing child launch paths so restarts cannot silently change the agent UID/GID.

Related Issue

Closes #2331
Supersedes #2335

Changes

• Add image and explicit fixed identity modes for Docker and Podman, with image mode as the default
• Inspect and pin final images by immutable ID, protect driver-owned identity metadata, and resolve numeric or named OCI users without NSS
• Persist resolved identity through the supervisor/gateway protocol and gate SSH and direct child launch on gateway acceptance
• Drop privileges with verified UID/GID namespace mappings, empty supplementary groups, and descriptor-safe account/state handling
• Reject external bind and named-volume mounts in image identity mode and reserve identity-sensitive mount targets
• Preserve the existing Kubernetes, OpenShift, and VM identity models while tombstoning local-driver metadata
• Update gateway configuration, driver documentation, architecture docs, examples, agent guidance, unit tests, and local-driver E2E coverage

Testing

• mise run pre-commit passes
• Unit tests added/updated
• Docker custom-image E2E passes: numeric passwd-less user, named user, invalid missing/root user, and external mount rejection
• Podman E2E was not run because Podman is unavailable in the local environment

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2476.docs.buildwithfern.com/openshell

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[matthewgrossman]

/ok to test