refactor(sandbox): remove unreachable root-side identity and workspace code

RFC 0012 moved the workload into its own capability-free container that
starts as the final sandbox identity. The sandbox no longer runs a root
supervisor that prepares the filesystem, rewrites account files, resolves
OCI USER entries, or drops privileges before launching the workload, so
that code had no production callers.

Remove the unreachable paths and their tests:

- prepare_filesystem / prepare_filesystem_with_identity, the /sandbox and
  OCI workspace chown preparation, and the root-side workspace validation
  (validate_oci_workspace and its privilege-dropped subprocess)
- the hidden validate-workspace subcommand
- drop_privileges / drop_privileges_with_identity, capability bounding set
  clearing, validate_sandbox_user/group, and /etc/passwd and /etc/group
  rewriting
- the sandbox-side OCI USER resolver (identity.rs) and
  ResolvedProcessIdentity; the boundary now writes the driver-resolved
  UID/GID into the policy directly

The workspace check that still runs inside the capability-free boundary
(validate_oci_workspace_as_effective_identity) is unchanged.

Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>

Author: matthewgrossman

crates/openshell-sandbox/src/boundary_server.rs

@@ -27,7 +27,6 @@ mod linux {
 
     use crate::boundary_io::BoundaryRuntimeState;
     use crate::delegated::{AgentSignaler, spawn_workload};
-    use crate::identity::{DriverIdentity, resolve_process_identity};
     use crate::main_session::{MainOutput, MainSession};
     use crate::network_broker::NetworkBroker;
     use crate::process::ProcessStatus;
@@ -2498,13 +2497,8 @@ mod linux {
                         .build()
                 );
             }
-            let driver_identity = DriverIdentity::Resolved {
-                uid: self.config.workload_identity.uid,
-                gid: self.config.workload_identity.gid,
-            };
-            if let Err(error) = resolve_process_identity(&mut policy, &driver_identity) {
-                return guest_error(BoundaryErrorKind::Process, error.to_string());
-            }
+            policy.process.run_as_user = Some(self.config.workload_identity.uid.to_string());
+            policy.process.run_as_group = Some(self.config.workload_identity.gid.to_string());
             let launch = ManagedProcessLaunch {
                 process_id: format!("{}:main:0", self.config.generation),
                 spec,