docs(mxc): recommend pc_least_privilege with registryRead capability

[craig-armadin]

Summary

All three published MXC driver configurations show pc_least_privilege disabled,
and none document what the setting does or that it defaults to false when
omitted. This updates the three examples to the secure combination and adds the
short explanation needed to choose between them.

Related Issue

No issue required: documentation fix to published example configuration.

Changes

• docs/reference/gateway-config.mdx - MXC example now sets
  pc_least_privilege = true and pc_capabilities = ["registryRead"]; adds two
  paragraphs covering the false default, why registryRead is required
  alongside LPAC, and why egress_proxy rather than internetClient is the way
  to grant network access.
• crates/openshell-driver-mxc/examples/mxc-gateway.toml - both keys uncommented
  and set, with comments noting the default and the capability requirement.
• crates/openshell-driver-mxc/README.md - configuration block matches, with the
  same note.

No code changes; defaults in MxcComputeConfig are untouched.

Testing

Verified on Windows 11 build 26200.9168 with MXC kit v0.8.0, against each of the
three published configurations.

Without pc_least_privilege, a sandboxed process that holds no network
capability and whose policy grants no network access can still cause an outbound
HTTPS request to an arbitrary external URL. It calls WinHttpGetProxyForUrl with
WINHTTP_AUTOPROXY_CONFIG_URL and an attacker-chosen lpszAutoConfigUrl; the
fetch is performed by WinHttpAutoProxySvc outside the container. The request
arrives at the destination with User-Agent: WinHttp-Autoproxy-Service/5.1,
confirmed with per-run cache-busting URLs so the hits could not be attributed to
caching or to the host. Direct sockets remain denied throughout —
socket() returns WSAEACCES.

With pc_least_privilege = true, the same call fails and no request reaches the
destination.

pc_least_privilege = true with the default empty pc_capabilities prevents
Winsock initialization, and workloads that link a network-capable runtime
terminate during startup rather than running without network access. Adding
registryRead restores startup; socket() still returns WSAEACCES.

Adding registryRead does not widen registry access. LPAC drops
ALL APPLICATION PACKAGES, which is the SID a non-LPAC sandbox reads the
registry through; registryRead restores access to a subset of the same keys.
The Winsock catalog keys under
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters carry ReadKey
ACEs for both SIDs — which is why LPAC alone breaks WSAStartup, and why this
capability repairs it. Across 17,143 keys sampled, no key grants registryRead
without also granting ALL APPLICATION PACKAGES, so the recommended
configuration reaches a strict subset of the published one: 16,154 keys
against 16,298.

• mise run pre-commit passes — ran the subtasks that apply to a docs-only
  change: license:check (1142 files, all SPDX headers present) and
  markdown:lint (145 files, 0 errors). markdown:format produces no
  changes. The remaining pre-commit subtask is rust:lint, which this diff
  cannot affect.
• Unit tests added/updated — not applicable, documentation only
• E2E tests added/updated (if applicable) — not applicable

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable) — not applicable

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @craig-armadin.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[craig-armadin]

I have read the DCO document and I hereby sign the DCO.