fix(gpu): derive CUDA-required Jetson sysfs policy

Start with the existing CDI-derived hardware policy and the rejection behavior from #1606, then review the evidence in #2846 and #8910. Define the minimum Jetson OpenRM sysfs contract, add hardware-free tests for approved, unsafe, missing, and non-GPU cases, and validate the required CUDA, onboarding, and lifecycle behavior on AGX Thor and IGX Orin.

Problem

Native Docker CDI can inject the Jetson GPU devices, libraries, and supplemental groups correctly, but the OpenShell supervisor's inner Landlock policy still prevents non-root CUDA initialization on NVIDIA Jetson AGX Thor.

This was isolated while validating the CDI stack in #1606 through #2775, #2776, #2265, and #2846 for NVIDIA/NemoClaw#7610 / NVIDIA/NemoClaw#8910:

host                                      cuInit(0)=0
plain Docker CDI                          cuInit(0)=0
same container and non-root UID/GIDs      cuInit(0)=0
OpenShell native CDI without sysfs access cuInit(0)=801
OpenShell native CDI with read-only /sys  cuInit(0)=0

The successful run used a qualification-only broad read-only /sys grant. That proves the missing boundary but is not an acceptable production fix. OpenShell remains the owner of CDI-derived hardware policy; downstream consumers must not guess or trust arbitrary additive paths.

Expected behavior

For a supported Jetson CDI device, OpenShell derives or supplies the minimum CUDA-required read-only sysfs contract and the non-root sandbox user can initialize CUDA. Non-GPU sandboxes receive no additional sysfs access. Missing, malformed, or unsafe hardware requirements fail closed with an actionable diagnostic.

Acceptance

• Identify and document the minimum sysfs paths required by Jetson OpenRM; do not grant broad /sys by default.
• Represent the requirement through a stable OpenShell-owned CDI/policy contract rather than a downstream static allowlist.
• Preserve the current rejection of unsafe broad CDI-derived paths from #1606.
• Add hardware-free policy tests for the derived/approved paths, unsafe paths, missing metadata, and the non-GPU negative case.
• On exact released commits, complete full onboarding with exit 0 and prove non-root nvidia-smi, /proc/<pid>/task/<tid>/comm write, and cuInit(0)=0 on both AGX Thor and IGX Orin.
• Prove CUDA remains usable after supported restart, resume, and rebuild lifecycles.

Current evidence

• NVIDIA/OpenShell#2846#issuecomment-5684128551 records the AGX Thor A/B result and the qualification-only workaround.
• NVIDIA/NemoClaw#8910#issuecomment-5684731268 records the accepted downstream ownership, compatibility, security, and validation decision.