feat(policy): allow non-root sandbox identities

[drew]

Summary

Allow explicitly selected sandbox workload UID/GID values across the full usable non-root Linux range instead of imposing an arbitrary system-user cutoff. Root and the invalid identity sentinel remain rejected, while the egress-exempt Kubernetes proxy UID retains its stricter infrastructure boundary.

This is a simpler alternative to #2737: it requires no new gateway configuration or min/max propagation.

Related Issue

Fixes #2707

Changes

• accept explicit workload UID/GID values from 1 through 4294967294
• continue rejecting root (0) and the Linux invalid-ID sentinel (4294967295)
• preserve the dedicated Kubernetes proxy UID minimum of 1000
• update driver, supervisor, network-init, and OpenShift SCC coverage
• document permission-collision risks for low numeric identities
• synchronize architecture guidance and related agent skills

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (queued through test:e2e and test:e2e-kubernetes)
• mise run test passes
• mise run ci passes in a clean system-gateway filesystem view

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

Label test:e2e applied for b7ec28b. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e applied for b7ec28b. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

Label test:e2e-kubernetes applied for b7ec28b. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute Kubernetes HA and credential-driver E2E after building the required gateway and supervisor images once. This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status.

[github-actions]

Label test:e2e-kubernetes applied for b7ec28b. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute Kubernetes HA and credential-driver E2E after building the required gateway and supervisor images once. This is an optional proof-of-life suite; failures are visible in the workflow run but do not publish a required CI gate status.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2785.docs.buildwithfern.com/openshell