fix(policy): support legitimate CDI policies above 256 paths

Problem

The native Docker CDI policy-enrichment path produced 301 filesystem paths for the NVIDIA Jetson AGX Thor qualification device, exceeding OpenShell's current 256-path policy limit before NemoClaw onboarding could complete.

The validation stack was #1606 through #2775, #2776, #2265, and #2846. A local 512-path change allowed qualification to proceed, but a blind limit increase is not a reviewed production solution: OpenShell must preserve a bounded, fail-closed policy while supporting legitimate CDI specifications.

Expected behavior

A legitimate selected Jetson CDI device can enrich the effective sandbox policy without exceeding an implementation-only ceiling. Duplicate or structurally redundant paths are normalized where safe. Excessive, malformed, conflicting, or adversarial requirements still fail closed with a diagnostic that reports the observed count and supported bound without dumping sensitive host metadata.

Acceptance

• Reproduce the 301-path AGX Thor CDI policy using a hardware-free fixture shaped from non-secret path metadata.
• Determine whether safe normalization/deduplication reduces the effective set; preserve distinct permissions and mount/device semantics.
• Define and document a bounded capacity that covers supported CDI devices, or replace the fixed entry ceiling with a resource limit tied to the actual policy representation.
• Add boundary tests at the accepted maximum, one above it, duplicate paths, conflicting access modes, and maliciously large input.
• Keep non-GPU sandbox policy and resource use unchanged.
• On the exact released OpenShell build, run the official ARM64 NemoClaw image through full AGX Thor and IGX Orin onboarding with exit 0 and no qualification-only limit patch.
• Re-run restart, resume, rebuild, non-GPU negative, and invalid/missing CDI fail-closed cases.

Current evidence

• NVIDIA/OpenShell#2846#issuecomment-5684128551 records the 301-path failure and local 512-path qualification change.
• NVIDIA/NemoClaw#8910#issuecomment-5684731268 records the accepted downstream ownership and release-gated validation contract.

Start by reproducing the 301-path NVIDIA Jetson AGX Thor CDI policy with a hardware-free fixture based on the issue's non-secret path metadata, then investigate safe normalization while preserving permissions and mount/device semantics. Add boundary, duplicate, conflict, oversized-input, and fail-closed coverage. Done requires a bounded policy decision, documentation, and successful exact-build ARM64 NemoClaw validation on AGX Thor and IGX Orin plus the listed restart, resume, rebuild, and negative cases.