NVIDIA NIM image support

Run sessions on NVIDIA NIM images and similar distroless-style images that ship a C library and bash but no package manager, no shadow-utils, no coreutils, no `/bin/sh`, and no `ldd`.

Three independent gaps in the agent and the kernel entrypoint block such images today; each is tracked as a child issue with its own PR:

|Gap|Child issue|PR|
|---|---|---|
|`entrypoint.sh` needs getent/groupadd/useradd/usermod/chpasswd and sed/cut|BA-7867|#14583|
|`entrypoint.sh` is started via its `#! /bin/sh` shebang|BA-7868|#14585 (stacked on #14583)|
|libc detection for label-less images needs `ldd`|BA-7869|#14587|

Done when a label-less NIM image starts a session on a live agent with the `work` user, its groups, password SSH login, and the correct kernel-runner variant, without any change to the image.

JIRA Issue: BA-7870

Start with entrypoint.sh and the kernel entrypoint, then read child issues BA-7867, BA-7868, and BA-7869 and their linked PRs to understand the three tracked gaps. Done means a label-less NVIDIA NIM image starts a session on a live agent with the work user, its groups, password SSH login, and the correct kernel-runner variant without changing the image.

Written by the indexing model from the issue text.