fix(gpu): derive CUDA-required Jetson sysfs policy

Bắt đầu với chính sách phần cứng hiện có được dẫn xuất từ CDI và hành vi từ chối trong #1606, sau đó xem xét các bằng chứng trong #2846 và #8910. Xác định hợp đồng sysfs tối thiểu của Jetson OpenRM, thêm các bài kiểm thử không cần phần cứng cho các trường hợp được phê duyệt, không an toàn, thiếu và không phải GPU, đồng thời xác thực hành vi bắt buộc về CUDA, onboarding và vòng đời trên AGX Thor và IGX Orin.

Problem

Native Docker CDI can inject the Jetson GPU devices, libraries, and supplemental groups correctly, but the OpenShell supervisor's inner Landlock policy still prevents non-root CUDA initialization on NVIDIA Jetson AGX Thor.

This was isolated while validating the CDI stack in #1606 through #2775, #2776, #2265, and #2846 for NVIDIA/NemoClaw#7610 / NVIDIA/NemoClaw#8910:

host                                      cuInit(0)=0
plain Docker CDI                          cuInit(0)=0
same container and non-root UID/GIDs      cuInit(0)=0
OpenShell native CDI without sysfs access cuInit(0)=801
OpenShell native CDI with read-only /sys  cuInit(0)=0

The successful run used a qualification-only broad read-only /sys grant. That proves the missing boundary but is not an acceptable production fix. OpenShell remains the owner of CDI-derived hardware policy; downstream consumers must not guess or trust arbitrary additive paths.

Expected behavior

For a supported Jetson CDI device, OpenShell derives or supplies the minimum CUDA-required read-only sysfs contract and the non-root sandbox user can initialize CUDA. Non-GPU sandboxes receive no additional sysfs access. Missing, malformed, or unsafe hardware requirements fail closed with an actionable diagnostic.

Acceptance

• Identify and document the minimum sysfs paths required by Jetson OpenRM; do not grant broad /sys by default.
• Represent the requirement through a stable OpenShell-owned CDI/policy contract rather than a downstream static allowlist.
• Preserve the current rejection of unsafe broad CDI-derived paths from #1606.
• Add hardware-free policy tests for the derived/approved paths, unsafe paths, missing metadata, and the non-GPU negative case.
• On exact released commits, complete full onboarding with exit 0 and prove non-root nvidia-smi, /proc/<pid>/task/<tid>/comm write, and cuInit(0)=0 on both AGX Thor and IGX Orin.
• Prove CUDA remains usable after supported restart, resume, and rebuild lifecycles.

Current evidence

• NVIDIA/OpenShell#2846#issuecomment-5684128551 records the AGX Thor A/B result and the qualification-only workaround.
• NVIDIA/NemoClaw#8910#issuecomment-5684731268 records the accepted downstream ownership, compatibility, security, and validation decision.