[ilanh]

Closes #70

Rebased onto main after #71 and #72 merged. The golden note now says OpenShell 0.1.7.

Adds a log fixture captured from a real OpenShell v0.1.7 sandbox: the playground image and policy, with ocsf_json_enabled=true.

• tests/fixtures/logs/ocsf-1.8.0.jsonl: 17 native OCSF 1.8.0 records (metadata.version is 1.8.0 on every line):
  • 4001 Open, allowed and denied
  • two 4001 Refuse records with policy_dns_ineligible
  • 4002 L7 allow and deny
  • one record each of 0 (relay open/close), 4007 (SSH) and 5019 (policy DNS mapped/staged), which diff-logs ignores
• Scrubbed:
  • Device hostname → sandbox.
  • Container → fixture with an all-zero UUID.
  • metadata.uid, SSH channel ids and DNS mapping ids → fixed fake UUIDs.
  • Real resolved IPs → 203.0.113.x (TEST-NET-3).
  • The 198.18.x synthetic IPs, the proxy loopback address and the public test hostnames are unchanged.
  • Timestamps rebased.
  • No usernames or tokens.
• tests/fixtures/ocsf-1.8.0-app/: a minimal annotated app that matches the captured run.
• tests/cli.rs diff_logs_reads_openshell_0_1_7_ocsf_1_8_0_records:
  • Checks 10 events: 3 denied, 7 allowed.
  • Expects missing_egress for example.com (curl) and pypi.org (python3.12), and l7_allow for httpbin.org POST /post.
  • Expects no manual items.
  • Adds the plain human golden tests/golden/diff_logs_ocsf_1_8_0_plain.txt.

Filesystem denials (two in the run) were not logged at all, which matches NVIDIA/OpenShell#4270 (still open).

Ran locally: fmt, clippy -D warnings, cargo test --locked, --test gateway_policies and gen-docs.sh --check all pass.