docs(gateway-config): fix stale community sandbox image path

[lunarwhite]

Summary

default_image/bootstrap_image examples in gateway-config.mdx, RFC, and the openshell-server test fixtures point at ghcr.io/nvidia/openshell/sandbox, which #267 removed from this repo in favor of NVIDIA/OpenShell-Community. Pulling that path now returns 403 denied (confirmed registry-side, not environment-specific: sibling gateway/supervisor/helm-chart images return 200 for the same anonymous request).

$ docker pull ghcr.io/nvidia/openshell/sandbox:latest
Error response from daemon: Head "https://ghcr.io/v2/nvidia/openshell/sandbox/manifests/latest": denied

$ docker pull ghcr.io/nvidia/openshell-community/sandboxes/base:latest
latest: Pulling from nvidia/openshell-community/sandboxes/base
Digest: sha256:aeef1c63f00e2913ea002ccb3aaf925f338b5c5d70e63576f0d95c16a138044e
Status: Image is up to date for ghcr.io/nvidia/openshell-community/sandboxes/base:latest
ghcr.io/nvidia/openshell-community/sandboxes/base:latest

This isn't a narrow doc corner: default_image is shared config across all four existing compute drivers (Docker, Podman, Kubernetes, VM) plus any new driver under development, and it's the first non-trivial example value in the "Shared driver defaults" block at the top of the canonical reference doc every driver README points to. I surfaced while building a new experimental compute driver locally. I have verified end-to-end the corrected path passed a full sandbox lifecycle (sandbox create -> exec -> delete) test against a live daemon, on both a cache-miss pull/convert and a cache-hit resolution of the same digest.

Related Issue

N/A. No behavior change.

Changes

• docs/reference/gateway-config.mdx: update all 6 default_image/bootstrap_image examples to ghcr.io/nvidia/openshell-community/sandboxes/base:latest
• rfc/0003-gateway-configuration/README.md: update the 5 default_image examples to the same path
• crates/openshell-server/src/config_file.rs: update the doc-comment example and test fixture strings to the corrected path to avoid future confusion
• crates/openshell-server/src/cli.rs: update the test fixture string to the corrected path to avoid future confusion
• Dropped version-style tags (:0.9, :1.0, :0.9.0) from default_image examples in favor of :latest (community sandbox images only ever publish latest/git-SHA tags, not semver)

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[elezar]

As a general nit: Could we use ghcr.io/nvidia/openshell-community/sandboxes/base:latest` everywhere?

The only place we use versions are in tests and I don't think they're relevant there. (I may be missing something though).

[lunarwhite]

@elezar Thanks for your review. Incorporated, and appended one note to the PR description:

Dropped version-style tags (:0.9, :1.0, :0.9.0) from default_image examples in favor of :latest (community sandbox images only ever publish latest/git-SHA tags, not semver)