fix(policy): support legitimate CDI policies above 256 paths

Inizia riproducendo la policy CDI 301-path di NVIDIA Jetson AGX Thor con un fixture privo di hardware basato sui metadati di percorso non segreti dell’issue, quindi indaga una normalizzazione sicura preservando i permessi e la semantica di mount/device. Aggiungi la copertura per confini, duplicati, conflitti, input sovradimensionati e comportamento fail-closed. Il lavoro è completato quando sono presenti una decisione di policy delimitata, la documentazione e una validazione riuscita di NemoClaw ARM64 con exact-build su AGX Thor e IGX Orin, oltre ai casi elencati di restart, resume, rebuild e ai casi negativi.

Problem

The native Docker CDI policy-enrichment path produced 301 filesystem paths for the NVIDIA Jetson AGX Thor qualification device, exceeding OpenShell's current 256-path policy limit before NemoClaw onboarding could complete.

The validation stack was #1606 through #2775, #2776, #2265, and #2846. A local 512-path change allowed qualification to proceed, but a blind limit increase is not a reviewed production solution: OpenShell must preserve a bounded, fail-closed policy while supporting legitimate CDI specifications.

Expected behavior

A legitimate selected Jetson CDI device can enrich the effective sandbox policy without exceeding an implementation-only ceiling. Duplicate or structurally redundant paths are normalized where safe. Excessive, malformed, conflicting, or adversarial requirements still fail closed with a diagnostic that reports the observed count and supported bound without dumping sensitive host metadata.

Acceptance

• Reproduce the 301-path AGX Thor CDI policy using a hardware-free fixture shaped from non-secret path metadata.
• Determine whether safe normalization/deduplication reduces the effective set; preserve distinct permissions and mount/device semantics.
• Define and document a bounded capacity that covers supported CDI devices, or replace the fixed entry ceiling with a resource limit tied to the actual policy representation.
• Add boundary tests at the accepted maximum, one above it, duplicate paths, conflicting access modes, and maliciously large input.
• Keep non-GPU sandbox policy and resource use unchanged.
• On the exact released OpenShell build, run the official ARM64 NemoClaw image through full AGX Thor and IGX Orin onboarding with exit 0 and no qualification-only limit patch.
• Re-run restart, resume, rebuild, non-GPU negative, and invalid/missing CDI fail-closed cases.

Current evidence

• NVIDIA/OpenShell#2846#issuecomment-5684128551 records the 301-path failure and local 512-path qualification change.
• NVIDIA/NemoClaw#8910#issuecomment-5684731268 records the accepted downstream ownership and release-gated validation contract.