feat(driver-mxc): default MXC admission settings to what the driver can enforce

Start with MxcComputeConfig::default() in crates/openshell-driver-mxc/src/driver.rs and admission_config_from_context in crates/openshell-server/src/compute/driver_config.rs. Run the existing MXC default-rejection and lifecycle tests, then check the gateway-config.mdx and sandbox-compute-drivers.mdx documentation. Done means omitted MXC settings allow creation, explicit admission remains rejecting, tests pass, and both docs explain the exception.

User Story

As an operator running the MXC compute driver on Windows, I want a fresh install or upgrade to start creating sandboxes without hand-editing admission settings, so that MXC keeps working out of the box after #3538 lands.

Problem Statement

#3538 makes external-resource admission on by default for every compute driver and disables caller-supplied template.driver_config by default. Both defaults are correct for the Linux and Kubernetes drivers, but they make the MXC driver reject every sandbox create under a default configuration:

• MXC requires template.driver_config.mxc with a non-empty command, so allow_driver_config = false rejects every request.
• Every MXC workload grants access to existing host filesystem objects, and MXC has no trusted label resolver, so resource_admission.enabled = true also rejects every request via reject_unlabelable.

An MXC gateway only works once the operator adds this to gateway.toml:

[openshell.drivers.mxc]
allow_driver_config = true

[openshell.drivers.mxc.resource_admission]
enabled = false

The docs (crates/openshell-driver-mxc/README.md, docs/reference/sandbox-compute-drivers.mdx) say this in prose, but the MXC example in docs/reference/gateway-config.mdx does not include it, and the failure surfaces as a per-create FailedPrecondition rather than at gateway startup.

Impact / Why This Matters

Anyone upgrading an MXC gateway across #3538 will see every sandbox create fail until they find the two settings. The workaround is a two-line config change, but it is undiscoverable from the error and undocumented in the main config example. MXC is not in scope for 0.1.0, so this is a fast-follow rather than a blocker.

Proposed Design

Make the MXC driver's default admission posture match what MXC can actually enforce, while still honoring explicit operator settings:

• With no allow_driver_config or resource_admission keys under [openshell.drivers.mxc], the gateway starts with caller driver config allowed and label admission disabled for MXC, and logs the existing "admission is DISABLED" warning at startup.
• An operator who explicitly sets resource_admission.enabled = true for MXC still gets today's behavior (every create is rejected with a clear message), so the exception is opt-out only by omission, never by overriding an explicit setting.
• Docs state that MXC is the one driver whose defaults differ, and why.

Implementation sketch (two touch points, because the gateway independently derives the expected policy and compares it against the driver's acknowledgement):

1. crates/openshell-driver-mxc/src/driver.rs: MxcComputeConfig::default() sets allow_driver_config: true and a ResourceAdmissionConfig with enabled: false.
2. crates/openshell-server/src/compute/driver_config.rs: admission_config_from_context applies the same defaults for the mxc driver when the fields are absent, before the try_into::<DriverAdmissionConfig>().

A cleaner but larger alternative is to let each driver registration declare its default admission policy, so the server does not hard-code a driver name.

Acceptance Criteria

• A gateway with [openshell.drivers.mxc] and no admission keys starts, acknowledges a disabled policy, and creates sandboxes with template.driver_config.mxc.command.
• A gateway with [openshell.drivers.mxc.resource_admission] enabled = true still rejects sandbox creates with the existing reject_unlabelable error.
• The existing MXC default-rejection test becomes an explicit-enable test; MXC lifecycle tests no longer need a custom admission config.
• docs/reference/gateway-config.mdx and docs/reference/sandbox-compute-drivers.mdx describe the MXC default exception.

Alternatives Considered

• Docs only. Add the two TOML lines to the MXC example in gateway-config.mdx. Cheapest, and worth doing regardless, but upgrades still break silently until the operator reads the docs.
• Startup preflight. Fail gateway startup when MXC is selected with admission enabled, with a message naming the two settings. Better error, but still requires manual config for every MXC install.
• Driver-declared defaults. Add a default admission policy to the compute driver registration so the server never hard-codes mxc. Preferred long-term shape; the sketch above is the minimal version and can be refactored into this later.