hydrator: read sandbox identity from device.container #23

Background

NVIDIA/OpenShell#5048 (merged after v0.1.7) moves supervisor sandbox identity from the top-level container object to device.container. Its release notes say parsers using top-level container.uid or container.name must update their mappings.

Problem

ans-ocsf-hydrator attributes records to agents only through the top-level container (internal/hydrator/agentmap.go, aggregate.go, activity.go). With the new shape, every supervisor record is unmapped:

• If all sandboxes run the new release, the run exits non-zero because nothing is attributed.
• If some sandboxes still run an earlier release, the run succeeds, and the upgraded sandboxes get no new observation.

Both the legacy outputs and openshell.behavior.activity are affected. The posted value shapes do not change.

Reproduction

Supervisor records from upstream's dev build of main at 1cdfe70 (0.1.8-dev.29+g1cdfe7088, Docker driver, ocsf_json_enabled=true) carry the sandbox only in device.container. With the sandbox mapped by name or UID, the hydrator on main attributes 0 of 14 records and exits with events were parsed but none of them mapped to a configured agent.

Proposal

Read device.container first and fall back to the top-level container, so mixed fleets keep working during upgrades. Do not read the device's own uid, name or hostname: upstream leaves uid and name empty on supervisor records and sets them to the gateway installation name on gateway records. Update the comments and example configuration that describe the old path and the removed schema downgrade.

Acceptance criteria

• Records with device.container.uid or device.container.name attribute exactly as top-level records do, including policy context.
• Records with only the top-level container behave as before; legacy and activity output for existing inputs is unchanged.
• A device object without a container, or with only its own uid/name, does not attribute.
• An input that mixes both shapes attributes every mapped sandbox.