fix(driver-vm): make sandbox_id authoritative and reject ambiguous name lookups

[rksharma-owg]

Summary

Lifecycle requests (stop_sandbox, start_sandbox, delete_sandbox) in the VM compute driver fell back to searching by sandbox_name whenever the supplied sandbox_id was missing or not found in the in-memory registry. Because sandbox names are unique per workspace rather than globally, and the driver request carries no workspace identifier, a prune sweep or lifecycle request with a missing or stale sandbox_id could resolve to a same-named sandbox in another workspace, chosen by HashMap iteration order.

This change introduces resolve_registry_id (mirroring resolve_pending_id from Docker driver fix #3240), making sandbox_id authoritative, eliminating the cross-workspace name fallback when an id is supplied, rejecting ambiguous name-only requests with FailedPrecondition, and scoping the create-time duplicate name check by workspace.

Related Issue

Fixes #3254

Changes

• crates/openshell-driver-vm/src/driver.rs:
  • Added resolve_registry_id helper:
    • sandbox_id is authoritative: if non-empty, checks presence in the registry and never consults sandbox_name as a fallback.
    • If sandbox_id is empty, resolves by sandbox_name. Rejects multiple matches across workspaces with FailedPrecondition("sandbox_name matches multiple sandboxes; specify sandbox_id") instead of non-deterministic hash iteration.
  • stop_sandbox: replaced inline fallback with resolve_registry_id.
  • start_sandbox: replaced inline fallback with resolve_registry_id.
  • delete_sandbox: replaced inline fallback with resolve_registry_id.
  • create_sandbox: scoped duplicate name check to record.snapshot.name == sandbox.name && record.snapshot.workspace == sandbox.workspace in addition to unique sandbox.id.
• Tests:
  • Added resolve_registry_id_prefers_sandbox_id_over_sandbox_name.
  • Added resolve_registry_id_ignores_the_name_when_the_id_is_not_registered.
  • Added resolve_registry_id_falls_back_to_the_name_when_no_id_is_supplied.
  • Added resolve_registry_id_rejects_an_ambiguous_name_only_lookup.
  • Added resolve_registry_id_returns_none_without_any_identifier.
  • Added duplicate_create_with_same_name_in_same_workspace_fails.

Testing

• Unit tests added/updated
• cargo check -p openshell-driver-vm passes
• cargo test -p openshell-driver-vm --lib resolve_registry_id passes (5/5)
• cargo test -p openshell-driver-vm --lib duplicate_create passes (2/2)
• cargo test -p openshell-driver-vm --lib lifecycle passes (14/14)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @rksharma-owg.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[rksharma-owg]

I have read the DCO document and I hereby sign the DCO.

[rksharma-owg]

Vouch request submitted in #3303. This PR will be reopened once approved by a maintainer.