test: add real OpenShell v0.1.7 OCSF 1.8.0 log fixtures #70

tests/fixtures/logs/ocsf.jsonl is hand-written and minimal: it has no metadata, type_uid, disposition or proxy_endpoint, and no Refuse record. Add a fixture trimmed from a real OpenShell v0.1.7 sandbox run, with every record's metadata.version = 1.8.0, plus a golden test for it.

Capture (MacBook, OpenShell 0.1.7 gateway and CLI, playground policy, ocsf_json_enabled=true). The run produced 42 records: classes 0, 4001 (Open allowed/denied, Refuse), 4002 (L7 allow/deny), 4007 (SSH) and 5019. Results:

• example.com:443 (curl) and pypi.org:443 (python3.12) are reported as missing.
• httpbin.org POST /post is reported as an L7 rule that is too narrow.
• Allowed events are counted.
• Filesystem denials are not logged (feat(sandbox): emit OCSF File System Activity for filesystem-policy denials and for opens of policy-named paths NVIDIA/OpenShell#4270 is still open).

The fixture should be scrubbed of device, container and host identifiers and of private IPs.