fix(gpu): derive CUDA-required Jetson sysfs policy #3348

Problem

Native Docker CDI can inject the Jetson GPU devices, libraries, and supplemental groups correctly, but the OpenShell supervisor's inner Landlock policy still prevents non-root CUDA initialization on NVIDIA Jetson AGX Thor.

This was isolated while validating the CDI stack in #1606 through #2775, #2776, #2265, and #2846 for NVIDIA/NemoClaw#7610 / NVIDIA/NemoClaw#8910:

host                                      cuInit(0)=0
plain Docker CDI                          cuInit(0)=0
same container and non-root UID/GIDs      cuInit(0)=0
OpenShell native CDI without sysfs access cuInit(0)=801
OpenShell native CDI with read-only /sys  cuInit(0)=0

The successful run used a qualification-only broad read-only /sys grant. That proves the missing boundary but is not an acceptable production fix. OpenShell remains the owner of CDI-derived hardware policy; downstream consumers must not guess or trust arbitrary additive paths.

Expected behavior

For a supported Jetson CDI device, OpenShell derives or supplies the minimum CUDA-required read-only sysfs contract and the non-root sandbox user can initialize CUDA. Non-GPU sandboxes receive no additional sysfs access. Missing, malformed, or unsafe hardware requirements fail closed with an actionable diagnostic.

Acceptance

• Identify and document the minimum sysfs paths required by Jetson OpenRM; do not grant broad /sys by default.
• Represent the requirement through a stable OpenShell-owned CDI/policy contract rather than a downstream static allowlist.
• Preserve the current rejection of unsafe broad CDI-derived paths from feat(gpu): derive sandbox access requirements from CDI specs #1606.
• Add hardware-free policy tests for the derived/approved paths, unsafe paths, missing metadata, and the non-GPU negative case.
• On exact released commits, complete full onboarding with exit 0 and prove non-root nvidia-smi, /proc/<pid>/task/<tid>/comm write, and cuInit(0)=0 on both AGX Thor and IGX Orin.
• Prove CUDA remains usable after supported restart, resume, and rebuild lifecycles.

Current evidence

• fix(supervisor): preserve standard sbin paths in sandbox shells #2846#issuecomment-5684128551 records the AGX Thor A/B result and the qualification-only workaround.
• feat(onboard): preserve Jetson GPU device groups NemoClaw#8910#issuecomment-5684731268 records the accepted downstream ownership, compatibility, security, and validation decision.