fix(server): normalise process identity on policy update for custom-image sandboxes

[johntmyers]

Summary

Enforce that run_as_user and run_as_group must always be "sandbox" in sandbox policies. If omitted from YAML, they are defaulted server-side. Any other value is rejected.

This fixes openshell policy set failing with "process policy cannot be changed on a live sandbox" for sandboxes created with custom images (--from), where the CLI was clearing identity fields but the YAML had sandbox explicitly set, causing a mismatch the server rejected.

Approach

Replace the previous clear_process_identity() → maybe_infer_sandbox_user() roundtrip with strict enforcement:

• Server-side defaulting: ensure_sandbox_process_identity() fills in "sandbox" for missing/empty run_as_user/run_as_group in both CreateSandbox and update_sandbox_policy
• Validation: validate_policy_safety() rejects any value that isn't "sandbox" (renamed RootProcessIdentity → InvalidProcessIdentity)
• Sandbox-side validation: validate_sandbox_user() replaces maybe_infer_sandbox_user() — fails fast if the sandbox user doesn't exist in /etc/passwd
• CLI/TUI cleanup: Removed clear_process_identity() calls — no longer needed since the server handles defaulting

Changes

File	What changed
crates/navigator-policy/src/lib.rs	Added ensure_sandbox_process_identity(), renamed RootProcessIdentity → InvalidProcessIdentity, updated validation to reject non-sandbox values, removed is_root_identity() and clear_process_identity()
crates/navigator-server/src/grpc.rs	Call ensure_sandbox_process_identity() + validate_policy_safety() in both CreateSandbox and update_sandbox_policy
crates/navigator-cli/src/run.rs	Removed clear_process_identity block for custom images
crates/navigator-tui/src/lib.rs	Removed clear_process_identity call for custom images
crates/navigator-sandbox/src/lib.rs	Replaced maybe_infer_sandbox_user with validate_sandbox_user (fail-fast)
crates/navigator-sandbox/src/opa.rs	Updated test policies: run_as_user: "" → run_as_user: sandbox

Testing

• All 471+ unit tests pass (cargo test --workspace)
• Pre-commit passes (lint, format, license, python tests)
• E2E: test_live_policy_update_and_logs, test_policy_validation (pending cluster redeploy)