feat(supervisor): expose sandbox name to middleware request context

[letv1nnn]

Summary

Adds the originating sandbox name to the supervisor middleware request context. Operator-run middleware already receives the sandbox ID; passing the name alongside it lets audit and approval interfaces show a human-readable identifier instead of an opaque UUID, using data the supervisor already owns.

Related Issue

Closes #2754

Changes

• Add sandbox_name field to RequestContext in proto/supervisor_middleware.proto; existing field numbers are unchanged for wire compatibility.
• Add sandbox_name to openshell_supervisor_middleware::HttpRequestInput and carry it into the gRPC RequestContext.
• Populate sandbox_id and sandbox_name from the process-wide openshell_ocsf::SandboxContext when the network supervisor builds middleware input.
• Inject the SandboxContext into middleware_request_input instead of reading the global inside it, making the identifier copy unit-testable with a real name.
• Document the request-context identifiers and their empty-string fallback in docs/extensibility/supervisor-middleware.mdx.
• Drop the #[cfg(target_os = "linux")] gate on the std::path::Path import in openshell-driver-podman's container.rs. Path is used unconditionally in a public function signature, so the gated import broke the non-Linux (macOS) build after merging main. Unrelated to the feature but required for the branch to compile cross-platform.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[pimlock]

Please also add workspace to RequestContext as string workspace = 5, preserving the existing field numbers and matching the other workspace-aware APIs. Populate it from the canonical workspace already learned through GetSandboxConfigResponse.workspace, and propagate it through both HTTP and WebSocket requests.

Please add assertions for both paths.

[pimlock]

Please clearly document here and in the protobuf field comment that sandbox_name is for display and logging only. Names are workspace-scoped and may be reused for different sandbox instances. Consumers must use sandbox_id for authorization, persistence, durable correlation, and identity.