refactor: deduplicate shared code across ocsf builders and driver crates

[ericcurtin]

Summary

Eliminate several categories of repeated code identified across the OCSF builder layer and compute driver crates. No behavioral changes — pure structural deduplication.

Related Issue

N/A

Changes

openshell-ocsf — OCSF builder deduplication (~90 lines removed)

• Add impl_builder_setters! macro in builders/mod.rs that generates the identical severity(), status(), and message() setter methods present on all 7 OCSF event builders (two variants: with and without status)
• Add SandboxContext::apply_common_fields() to consolidate the four-line finalization pattern (set_status, set_message, set_device, set_container) repeated in every builder's build() method
• Update all 7 builder files to use the macro and helper

openshell-core — two new shared driver utilities

• driver_utils::sandbox_token_path(driver_subdir, namespace, sandbox_id) — centralizes the XDG state path construction for sandbox JWT token files previously duplicated between the Docker and Podman drivers
• driver_utils::build_capabilities_response(name, version, image, gpu) — centralizes the GetCapabilitiesResponse struct literal repeated across the Docker, Podman, and Kubernetes compute drivers

openshell-driver-docker, openshell-driver-podman, openshell-driver-kubernetes

• Token path functions and capabilities() methods now delegate to the shared helpers above

Skipped (differences were too significant to abstract cleanly): gRPC ComputeDriverService adapters (different error types and method signatures between k8s and podman), persistence store backends, test PKI helpers, provider boilerplate files.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[pimlock]

/ok to test 9aae562