feat(supervisor): identify the process behind each network event - #5251

Summary

Network and HTTP events from boundary-mediated connections named the binary with pid 0 (bash(0)). The runtime already read the caller's pid, parent pid, and start time while resolving its identity; this carries them to the supervisor so the OCSF actor identifies the actual process.

First of a stack of four for #4268:

1. feat(supervisor): identify the process behind each network event #5251 This PR: identify the process behind each network event
2. feat(supervisor): record launch and exit of sandbox sessions #5252 Record launch and exit of sandbox sessions
3. feat(supervisor): record each exec in the workload and its exit #5253 Record each exec in the workload and its exit
4. feat(supervisor): record the command line of each process #5254 Record the command line of each process

Related Issue

Refs #4268

Changes

• BinaryIdentity and ResolvedBinaryIdentity carry the owning process (thread-group pid, parent pid, start time) as audit context. It never authorizes.
• The supervisor sets actor.process.pid, created_time, and the parent's pid on network and HTTP events. pid + created_time identify one process even after pid reuse, and are the join key the later PRs use.
• Resolution records the thread group, so a connection from any thread reports the leader's pid and start time, and ancestry stops at the process-tree root's thread group.

Before:

OCSF NET:OPEN [INFO] ALLOWED /usr/bin/bash(0) -> example.com:443 [policy:demo engine:opa]
{"class_name":"Network Activity","activity_name":"Open","actor":{"name":"/usr/bin/bash","pid":0,"cmd_line":"-"}}

After (in-sandbox: pid=82 ppid=78):

OCSF NET:OPEN [INFO] ALLOWED /usr/bin/bash(82) -> example.com:443 [policy:demo engine:opa]
{"class_name":"Network Activity","activity_name":"Open","actor":{"name":"/usr/bin/bash","pid":82,"cmd_line":"-","parent_process":{"name":"/usr/bin/bash","pid":78},"created_time":1793756699220}}

created_time matches the process's start time from /proc/<pid>/stat in the sandbox.

Known limitations:

• L7 per-request HTTP events still carry no actor.
• The windows branch needs process: None at openshell-mxc-boundary/src/launch.rs and openshell-supervisor/src/backend_setup/mxc.rs when it next merges main.

Testing

• Lockfile checks, rust:format:check, and every CI clippy invocation (--locked, including perf-harness) pass on macOS and the aarch64 Linux target for this commit
• Unit tests added/updated; sandbox, sandbox-backend, and supervisor suites pass in an Ubuntu 24.04 guest (kernel 6.8)
• Manual end-to-end: gateway + Docker sandbox (kernel 7.0), before/after OCSF JSONL above

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)