feat(sandbox): support policy discovery and restrictive defaults on sandbox containers

[drew]

Closes #82

Summary

• Allow sandboxes to operate without a pre-configured policy by supporting three resolution modes: policy from gateway (unchanged), policy from disk (/etc/navigator/policy.yaml), or a hardcoded restrictive default that blocks all network access
• When the sandbox discovers policy locally, it syncs to the gateway via UpdateSandboxPolicy and re-reads the canonical version, keeping the gateway as the authoritative source
• Pass NEMOCLAW_SANDBOX_NAME env var to sandbox pods so the sandbox can identify itself for the UpdateSandboxPolicy RPC

Changes

navigator-policy (crates/navigator-policy/src/lib.rs)

• Added restrictive_default_policy() - returns a hardcoded policy with filesystem access, landlock, process identity, but no network policies (all network blocked) and no inference
• Added CONTAINER_POLICY_PATH constant (/etc/navigator/policy.yaml) - well-known path for container-shipped policies
• Added 12 unit tests

navigator-server (crates/navigator-server/src/grpc.rs)

• create_sandbox: removed spec.policy.is_none() rejection - policy is now optional
• get_sandbox_policy: returns policy: None, version: 0 when no policy is configured (instead of erroring)
• update_sandbox_policy: when spec.policy is None (no baseline), skips static field/network mode validation and backfills spec.policy on the stored sandbox so future updates can validate against it
• Added 6 unit tests

navigator-server (crates/navigator-server/src/sandbox/mod.rs)

• Threaded sandbox_name through sandbox_to_k8s_spec → sandbox_template_to_k8s → inject_pod_template → update_container_env → build_env_list → apply_required_env
• Added NEMOCLAW_SANDBOX_NAME env var to the pod spec

navigator-sandbox

• Cargo.toml: Added navigator-policy dependency
• main.rs: Added --sandbox-name / NEMOCLAW_SANDBOX_NAME CLI arg
• grpc_client.rs: Changed fetch_policy to return Option<ProtoSandboxPolicy> (None = no policy configured); added sync_policy() method
• lib.rs: Added sandbox_name param to run_sandbox and load_policy; new discover_policy_from_disk_or_default(), discover_policy_from_path(), sync_discovered_policy() functions; 4 new tests

Policy Resolution Flow

gRPC mode:
  1. Call GetSandboxPolicy
  2. If policy returned → use it (existing behavior)
  3. If policy is None (version 0):
     a. Try to read /etc/navigator/policy.yaml
     b. If found → parse YAML, sync to gateway via UpdateSandboxPolicy
     c. If not found → use restrictive_default_policy(), sync to gateway
     d. Re-fetch from gateway to get canonical version/hash
     e. Proceed with the fetched policy

Test Plan

• 22 new unit tests across 3 crates (12 policy, 4 sandbox, 6 server)
• All 228+ existing tests continue to pass
• mise run pre-commit passes (format, lint, tests, license checks)