feat(policy): add portable UI policy controls

[shailendra-nv]

Summary

Add a platform-neutral, deny-by-default ui policy section and compute-driver
capability negotiation. MXC process_container maps the policy to MXC UI
controls, while unsupported runtimes reject every explicit UI section before
provisioning and preserve existing behavior when the section is omitted.

Related Issue

Closes #3022

Changes

• Add portable allow_graphical_ui, directional clipboard, and
  allow_input_injection policy controls to the Rust and protobuf models.
• Add a compute-driver capability for complete UI-policy enforcement and expose
  it through gateway health output and the Go SDK.
• Reject every explicit UI object, including ui: {}, when a selected driver
  does not advertise support. Docker, Podman, Kubernetes, VM, non-Windows
  builds, older extensions, and MXC isolation_session therefore remain
  default-deny for the new policy surface.
• Map UI policy only for MXC process_container; keep omitted policy
  restrictive and reject unknown enum values or lossy mappings.
• Update policy hashing/static-update checks, schema documentation,
  architecture documentation, MXC documentation, policy-generation skills,
  Windows validation tasks, and Go SDK conversions.
• Add policy parsing/validation, capability, unsupported-driver, mapper,
  lifecycle, real-MXC schema, SDK, and end-to-end tests.

Testing

Validated commit: de2f8345c53a9afd721519b89c5e854a9a781928

• mise run pre-commit passes
  • Formatting, Markdown, Python formatting, TypeScript install, and license
    checks pass on native Windows x64.
  • The repository-wide Rust lint step stops on two existing
    clippy::result_large_err findings in
    crates/openshell-server/src/config_file.rs:288 and
    crates/openshell-server/src/lib.rs:519. The branch introduces no
    additional Clippy finding.
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Windows build and static validation:

• mise run --skip-tools windows:check:arm64 — pass
• mise run --skip-tools windows:build:arm64 — pass
• mise run --skip-tools windows:check:x64 — pass on native x64
• mise run --skip-tools windows:build:x64 — pass on native x64

Test execution accounting:

Suite / lane	Command	Total	Passed	Skipped / ignored	Failed	Result
ARM64 workspace	mise run --skip-tools windows:test:arm64	3,607	3,578	26	3	Known Windows baselines
ARM64 OIDC isolated rerun	Existing test binary, exact filter	1	1	0	0	Pass
ARM64 unsupported-driver contract	mise run --skip-tools windows:test:unsupported:arm64	1	1	0	0	Pass
ARM64 mock MXC E2E	Mock scenario runner	4	4	0	0	Pass
ARM64 real MXC	mise run --skip-tools windows:test:mxc-real:arm64	11	8	3	0	Pass
x64 workspace	mise run --skip-tools windows:test:x64	3,607	3,579	26	2	Known Windows baselines
x64 unsupported-driver contract	mise run --skip-tools windows:test:unsupported:x64	1	1	0	0	Pass
x64 mock MXC E2E	Mock runner with an in-memory database	4	4	0	0	Pass
x64 real MXC	mise run --skip-tools windows:test:mxc-real:x64	11	10	1	0	Pass
All test executions		7,247	7,186	56	5

The five workspace failures include the same two existing
openshell-conformance fixtures on each architecture; those fixtures use Unix
/usr/local/... paths with Windows Path::is_absolute(). ARM64 also hit one
timing-sensitive OIDC assertion under full-suite load. That exact test passed
immediately in isolation. All branch-related tests passed.

The real-MXC harness reports unavailable backend or velocity facilities as
explicit SKIP messages, although Cargo records those early-returning tests as
passed. The table classifies them as skipped.

MXC compatibility:

• Latest released MXC 0.8.0+6cd3d58f — real-MXC suites pass on ARM64 and x64
• Microsoft MXC main at 3a22a2b94a81da081d260b087c4c7faeb7be7f14
  — ARM64 builds pass both with and without isolation_session; the real-MXC
  suite passes in both configurations
• Representative mapper output validates against MXC stable
  0.8.0-alpha, dev 0.9.0-alpha, and rolling 0.9.0-dev schemas

Go SDK:

• Native Windows x64 go build ./... — pass
• Native Windows x64 golangci-lint run ./... — 0 issues
• Changed converter package tests — pass on ARM64 and native x64
• Pinned Buf/protobuf regeneration — no content diff
• All nine changed committed Go blobs are stable under gofmt
• The stock go:test task cannot start on Windows because it always requests
  -race while CGO is disabled. Running go test ./... without -race
  passes the changed converter package and reproduces existing Windows path and
  browser-command assumptions in unrelated packages.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.