feat(sandbox): add delegated identity for token exchange

[grs]

Summary

Add opt-in delegated OIDC identity support for sandboxes so token-exchange provider profiles can use the sandbox creator’s bounded identity instead of a stored provider subject credential. This adds gateway managed delegated credential storage, sandbox delegation lifecycle APIs, CLI commands for enabling, extending, withdrawing, and administering delegation.

Note this builds on PR #1970, which adds the basic token exchange capability.

Example CLI flow:

openshell sandbox create \
  --provider protected-services \
  --delegate-identity-for=8h

openshell sandbox delegated-identity status my-sandbox
openshell sandbox delegated-identity extend my-sandbox --for=12h
openshell sandbox delegated-identity withdraw my-sandbox

Related Issue

Fixes #1987

Changes

• Added sandbox_delegated_identity as a token-exchange subject source.
• Added sandbox delegation status, withdraw, and extend APIs.
• Added platform-admin delegated credential list, status, revoke, and delete APIs.
• Added openshell sandbox create --delegate-identity-for and related CLI commands.
• Updated provider docs, sandbox architecture docs, tests, and generated Go proto bindings.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)
• Manual testing with different users/roles

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[zanetworker]

The --delegate-identity-for flag name makes this feel like infrastructure plumbing when it's really a trust decision. Something like --act-as-me (or something like that) immediately communicates what the user is agreeing to without requiring identity semantics knowledge.

# Current
openshell sandbox create --provider svc --delegate-identity-for=8h

# Options
openshell sandbox create --provider svc --act-as-me-for=8h
openshell sandbox create --provider svc --act-on-my-behalf-for=8h
...