feat(server): add opt-in KVM access for Linux Docker sandboxes

[kernalix7]

Summary

• Add exact resourceLimits.kvm: "1" opt-in for generic Linux sandboxes on a local Docker runtime.
• Validate server-visible /dev/kvm with lstat as character device 10:232, map only /dev/kvm:/dev/kvm:rw into the main container, and add only its non-root GID.
• Reject invalid values, unsafe devices, remote Docker endpoints, and Kubernetes requests before provisioning; preserve existing Windows/QEMU behavior and egress-sidecar isolation.
• Document the runtime/security boundary and regenerate the JavaScript lifecycle API declaration.

Closes #1676

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Validation performed:

• Server Ruff and focused Pyright: clean
• Focused Docker KVM and Kubernetes resource tests: 42 passed
• Full server suite: 1617 passed, 7 skipped
• Python SDK generator, Ruff, Pyright, and tests: passed
• JavaScript SDK lint, typecheck, build, and 104 tests: passed
• CLI help tests: 52 passed
• VitePress documentation build: passed
• git diff --check: clean

Real Docker/KVM E2E was not run because this environment has neither Docker nor /dev/kvm. Kotlin lifecycle generation was not run because no JDK is installed; its generated build output is ignored and untracked. Python package build was not run because the local environment lacks the build backend, while generator/lint/type/tests passed.

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b1556d2de

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".