feat(cli): add CPU/memory resource limit flags to sandbox create

[nvshridhar]

Summary

Add four optional CLI flags (--cpu-request, --cpu-limit, --memory-request, --memory-limit) to openshell sandbox create. These map to Kubernetes resource requests/limits via the existing DriverResourceRequirements proto fields and K8s driver. When omitted, behavior is unchanged.

Related Issue

Closes #1003

Changes

• crates/openshell-cli/src/main.rs: 4 new Clap args under RESOURCE FLAGS help heading, threaded through to sandbox_create and sandbox_create_with_bootstrap
• crates/openshell-cli/src/run.rs: New ResourceArgs struct with to_resources_struct() that builds the prost_types::Struct shape expected by the gateway server. Fixed SandboxTemplate construction to create a template when resources are specified even without a custom image
• crates/openshell-cli/tests/sandbox_create_lifecycle_integration.rs: Updated 5 call sites with &run::ResourceArgs::default() to match new function signatures

Testing

• cargo check -p openshell-cli --tests passes (lib + all integration tests)
• Unit tests added (3 tests: empty returns None, partial fields, all four fields)
• E2E tests added/updated (not applicable — no E2E infra changes)
• Manually tested on a local K3s cluster: sandbox creation with and without flags, verified K8s pod resource limits via kubectl describe pod, confirmed memory OOM at limit (exit 137), confirmed CPU throttle with 4 cores

Known limitation

No client-side validation of K8s quantity strings or request-vs-limit ordering. Invalid values are rejected by the K8s API server at pod creation time with a clear error. Client-side parsing of K8s quantities (millicores, binary suffixes) is out of scope for this PR.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable — no architectural changes)

Made with Cursor

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}

[nvshridhar]

I have read the DCO document and I hereby sign the DCO.

[nvshridhar]

rcheck