feat(sandbox): expose optional username and hostname

[ebusto]

Summary

Add opt-in sandbox username and hostname exposure. Users can expose their authenticated username without changing the sandbox UID/GID and copy the parent host FQDN into Docker sandboxes.

Related Issue

Closes #4216

Changes

• Add --username and --hostname sandbox creation flags.
• Propagate these options through the public API and supported SDKs.
• Reconcile authenticated usernames across Docker, Podman, and VM runtimes.
• Configure Docker hostname, domain name, and local hostname resolution.
• Validate supported drivers and prevent caller-supplied identity overrides.
• Document the new sandbox creation options.
• Exclude reverse-DNS behavior from this change.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

Verification included the full pre-commit suite, focused Rust tests, Python tests, Go SDK tests, TypeScript tests/type checking/linting, protobuf linting, and generated-binding freshness checks.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.