bug(ocsf): top-level container is undefined in OCSF 1.8.0 event classes #4915

User Story

As an operator sending OpenShell OCSF records to a SIEM or a strict OCSF consumer, I want every native record to pass OCSF 1.8.0 validation, so that strict consumers accept the records and I don't need a pipeline step to drop or move fields.

Problem Statement

Sandbox-associated OCSF records carry a top-level container object. OCSF 1.8.0 does not define container as an event-class attribute; it defines it only under the container profile on objects such as device and process. Every native record with a sandbox identity therefore fails validation:

{"error":"attribute_unknown","message":"Unknown attribute at \"container\"; attribute \"container\" is not defined in class \"ssh_activity\" uid 4007."}

(https://schema.ocsf.io/api/1.8.0/v2/validate, same result for Network Activity, Base Event and Device Config State Change.)

The in-repo schema validator skips this attribute through KNOWN_UNDEFINED_EVENT_ATTRIBUTES in crates/openshell-ocsf/src/validation/schema.rs, so the tests stay green while the official validator rejects it. #4288 makes the rest of the native output conformant and leaves container unchanged; this issue tracks that remaining gap.

Impact / Why This Matters

• nano's strict OCSF validator rejects every native sandbox record, always on container alone (spike results).
• Tenzir ocsf_cast and Cribl's Parquet writer drop the field silently, so sandbox identity is lost there.
• The Cortex XSIAM OpenShell content pack (demisto/content PRs #46184 and #46275) reads top-level container.uid and container.name for sandbox attribution, so moving the field breaks that pack unless it is updated at the same time.

Acceptance Criteria

• Native sandbox records pass https://schema.ocsf.io/api/1.8.0/v2/validate with no attribute_unknown error for container.
• Sandbox identity (ID and name) stays available in a defined OCSF attribute, and the docs say where.
• KNOWN_UNDEFINED_EVENT_ATTRIBUTES no longer lists container.
• The XSIAM content pack maintainer is told about the change before it ships.

Suggested UX (if applicable)

Two options found so far:

1. Nest it as device.container and declare the container profile. The image object then requires uid, so the emitter must set the image ID or omit image.
2. Carry sandbox identity in unmapped or attributes only, and drop top-level container.

Option 1 keeps the data in a typed OCSF location.

Reproduction Steps

1. Enable supervisor OCSF JSONL for a sandbox: openshell settings set <sandbox> --key ocsf_json_enabled --value true.
2. Generate any activity, for example openshell sandbox exec --name <sandbox> -- true.
3. POST any OCSF-JSON record to https://schema.ocsf.io/api/1.8.0/v2/validate.
4. Observe attribute_unknown for container.

Environment

OpenShell 0.1.5 and main; any driver that emits sandbox-associated records.