Add shared-storage validation and cold-start metrics

Description

Add or reuse nvcf_shared_storage_cold_start_seconds to measure shared-storage cold-start latency by backend mode. Include the bounded labels secret_backend, shared_data_backend, and smb_server_expected, and emit one sample when a function deployment first becomes ready.

Document the encryption-at-rest evidence required for non-local clusters and clearly state when a local functional test does not validate that control.

Definition of Done

• Tests verify one cold-start sample per deployment and the expected backend labels.
• Validation guidance covers legacy SMB, native sensitive-data, and fully SMB-free modes.
• The runbook explains p50, p95, and p99 evaluation.
• The runbook requires encryption-at-rest evidence or an explicit non-production caveat.