fix(sandbox): use cgroup pids controller instead of RLIMIT_NPROC on K8s

[Arnonrgo]

Summary

• RLIMIT_NPROC is per-UID kernel-wide, not per-container — on dense K8s nodes, containers sharing the same UID exhaust the shared quota causing spurious EAGAIN from pthread_create
• When cgroup v2 pids controller is active, skip RLIMIT_NPROC entirely (cgroup provides per-container fork-bomb protection)
• Fall back to RLIMIT_NPROC on systems without cgroup pids support

Changes

• Replace inline RLIMIT_NPROC logic with limit_pids() that detects cgroup v2 pids controller
• Add OPENSHELL_MAX_PIDS env var for configurable limit (default: 512)
• Add cgroup_pids_active() detection via /sys/fs/cgroup/pids.max

Testing

• Unit test: default max_pids returns 512
• Unit test: OPENSHELL_MAX_PIDS env override works
• Unit test: invalid env value falls back to default
• Unit test: cgroup_pids_active() doesn't panic (Linux only)
• cargo check -p openshell-sandbox passes

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}

[github-actions]

Thank you for your interest in contributing to OpenShell, @Arnonrgo.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.