fix(mxc): reject cpu/memory limits instead of silently discarding them

[pkhodade-NV]

Summary

• The MXC driver's CreateSandbox accepted --cpu/--memory and reached Ready with no Job Object enforcement and no diagnostic anywhere (CLI, gateway log, OCSF), leaving the SDD's T11 host-exhaustion mitigation silently unmet.
• MXC's schema does not expose CPU rate control or memory limiting outside the WSLC backend, so this driver cannot honor these limits today.
• CreateSandbox (and validate_sandbox_create) now reject any request carrying cpu_limit, cpu_request, memory_limit, or memory_request synchronously with InvalidArgument, matching the existing fail-closed rejection already used for GPU requests on this driver.
• Documented the new capability-matrix row in crates/openshell-driver-mxc/README.md.

Related Issue

NVBug 6782894

Changes

• crates/openshell-driver-mxc/src/driver.rs: validate_sandbox_fields now rejects non-empty cpu/memory resource requirements on DriverSandboxTemplate.resources; added cpu_and_memory_limits_are_rejected_fail_closed regression test.
• crates/openshell-driver-mxc/README.md: documented the unsupported-resource-limits capability row.

Testing

• cargo test -p openshell-driver-mxc --lib — 101 passed
• cargo clippy -p openshell-driver-mxc --tests --target aarch64-pc-windows-msvc -- -D warnings -A dead-code -A unused-imports -A clippy::unused-async — clean
• cargo build --release -p openshell-gateway -p openshell-cli -p openshell-supervisor-relay (ARM64 host) — builds openshell-gateway.exe, openshell.exe, openshell-supervisor-relay.exe successfully

Checklist

• Tests added/updated
• Docs updated
• Lint/build clean locally

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.