fix(vm): restore sandboxes after gateway restart

[drew]

Summary

Restore VM sandboxes when a standalone gateway restarts by persisting driver launch metadata and preserving the writable overlay disk.

Related Issue

N/A

Changes

• Persist VM driver sandbox requests to sandbox.pb with owner-only permissions and scan them on driver startup
• Recreate VM launcher processes during driver startup while preserving existing overlay.ext4 state
• Add dedicated VM gateway-resume e2e coverage in vm_gateway_resume, gated by the new e2e-vm feature
• Keep Docker gateway resume coverage on gateway_resume under e2e-docker
• Configure the VM e2e wrapper to use e2e-vm by default and document restart behavior

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated
• cargo test -p openshell-driver-vm
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-docker --test gateway_resume -- --nocapture
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-vm --test vm_gateway_resume -- --nocapture
• cargo test --manifest-path e2e/rust/Cargo.toml --features e2e-vm --test smoke --no-run
• bash -n e2e/rust/e2e-vm.sh
• Live VM e2e with OPENSHELL_E2E_VM_TEST=vm_gateway_resume e2e/rust/e2e-vm.sh not run locally because target/vm-runtime-compressed is absent

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1407.docs.buildwithfern.com/openshell