feat(api)!: model CPU and memory as typed compute resource requirements

[elezar]

Summary

• Adds typed cpu/memory fields to ResourceRequirements in the public API and compute-driver protos, replacing the Struct-based SandboxTemplate.resources passthrough for portable CPU/memory sizing.
• openshell sandbox create --cpu/--memory now populate the typed fields instead of a Kubernetes-shaped Struct.
• Gateway validation rejects legacy template.resources.limits/requests.cpu|memory with a clear migration error.
• Kubernetes, Docker, and Podman drivers consume the typed compute requirements. VM and MXC drivers explicitly reject typed CPU/memory (fail_precondition) until sizing support lands there, rather than silently ignoring it.
• CPU/memory quantity validation (--cpu/--memory parsing rules) is shared between the CLI and gateway via a new openshell-core::quantity module instead of being duplicated.
• The Go SDK now exposes typed GPU/CPU/memory resource requirements (types.ResourceRequirements, mirroring the proto shape) instead of only GPU.
• architecture/compute-runtimes.md documents the typed CPU/memory model and per-driver support/rejection behavior.

This is still a draft — public docs (docs/sandboxes/manage-sandboxes.mdx, docs/reference/sandbox-compute-drivers.mdx) and the TypeScript/Python SDK curated surfaces called out in the issue's acceptance criteria are not yet done.

Related Issue

Part of #2838.

Changes

• proto/openshell.proto, proto/compute_driver.proto: typed CpuResourceRequirements/MemoryResourceRequirements under ResourceRequirements; old DriverSandboxTemplate.resources/DriverResourceRequirements reserved.
• crates/openshell-cli/src/run.rs, main.rs: --cpu/--memory build typed requirements.
• crates/openshell-core/src/quantity.rs (new): shared CPU/memory quantity validation used by both the CLI and gateway.
• crates/openshell-server/src/grpc/validation.rs: validates typed compute requirements; rejects legacy template.resources CPU/memory fields.
• crates/openshell-server/src/compute/mod.rs: gateway-to-driver translation for typed requirements.
• crates/openshell-driver-kubernetes, -docker, -podman: consume typed CPU/memory.
• crates/openshell-driver-vm, -mxc: explicitly reject typed CPU/memory until supported.
• crates/openshell-sdk/src/client.rs: passthrough update.
• sdk/go/openshell/v1/types/sandbox.go, internal/converter/sandbox.go, fake/sandbox.go: typed ResourceRequirements{GPU, CPU, Memory} replacing GPU-only handling (breaking rename: SandboxSpec.GPUCount → SandboxSpec.ResourceRequirements.GPU.Count).
• architecture/compute-runtimes.md: documents the typed resource model and driver support matrix.

Testing

• cargo test --workspace --lib --bins passes.
• mise run pre-commit passes (includes cargo clippy --workspace --all-targets -- -D warnings, cargo fmt --check, helm lint, license headers, markdown lint).
• mise run go:lint, mise run go:test, mise run go:proto:check, gofmt -l pass for the Go SDK.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Unit tests added/updated
• Docs updated (outstanding — draft)
• TypeScript/Python SDK surface updated (outstanding — draft)
• E2E tests
• Architecture docs

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[elezar]

/ok-to-test cd3f905