docs(gateway-config): remove invalid sandbox_uid from VM driver example

[Bobbins228]

Summary

• Remove the commented-out sandbox_uid field from the VM driver TOML example in docs/reference/gateway-config.mdx
• VmComputeConfig uses deny_unknown_fields — uncommenting the line crashes the gateway with "unknown field sandbox_uid"
• The field exists on the internal VmDriverConfig subprocess (crates/openshell-driver-vm/src/driver.rs:231), set via --sandbox-uid CLI arg, not through the gateway TOML

Related Issue

Fixes #2364

Changes

Removed 3 lines (comment block + commented-out field) from the VM driver example in docs/reference/gateway-config.mdx. The Kubernetes driver example correctly retains sandbox_uid since KubernetesComputeConfig accepts it.

Testing

• Verified uncommenting the field causes gateway startup crash
• Verified the field is accepted on the openshell-driver-vm subprocess via --sandbox-uid
• mise run pre-commit passes (markdown lint, license check, helm lint)

Checklist

• Conventional commit format
• DCO sign-off
• No unrelated changes

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[Bobbins228]

I have read the DCO document and I hereby sign the DCO.

[Bobbins228]

recheck

[elezar]

@matthewgrossman this seems related to #2335

@Bobbins228 my question here would be whether the longer term fix would not be to add the missing fields to the VM config instead of updating the example.

[elezar]

Thanks for addressing the startup failure reported in #2364. I think this change fixes the symptom in the wrong direction, though: the VM documentation describes an intended configuration surface whose gateway wiring is incomplete.

The broader runtime-identity work points toward completing that wiring:

• Umbrella issue #1959 explicitly calls for the VM driver to use a configurable UID instead of the hardcoded 10001.
• Commit b3d3976e1 added sandbox_uid / sandbox_gid to VmDriverConfig, added the VM driver CLI/environment inputs, and documented [openshell.drivers.vm] configuration.
• PR #2335 completes the same operator-owned sandbox_uid / sandbox_gid contract for Docker and Podman. Kubernetes already implements it end to end.
• docs/reference/sandbox-compute-drivers.mdx still says that sandbox_uid is configurable under [openshell.drivers.vm], so removing only this example leaves the documentation internally inconsistent.

Please complete the VM gateway link instead:

1. Add optional sandbox_uid and sandbox_gid fields to VmComputeConfig.
2. Forward configured values as --sandbox-uid and --sandbox-gid when spawning openshell-driver-vm.
3. Validate them against the shared sandbox identity range, preferably before spawning the child.
4. Add config parsing/default and spawn-argument coverage.
5. Keep the VM configuration documentation, including the existing default semantics (UID 10001; GID defaults to the resolved UID).

That would make #2364 a useful regression report for the missing gateway plumbing and align VM with #1959 and #2335, rather than making VM the only built-in driver whose operator identity setting is unavailable through gateway TOML.