fix(policy): support legitimate CDI policies above 256 paths

Bắt đầu bằng cách tái hiện policy CDI 301-path của NVIDIA Jetson AGX Thor bằng một fixture không cần phần cứng, dựa trên metadata đường dẫn không chứa bí mật của issue, sau đó điều tra việc chuẩn hóa an toàn trong khi vẫn bảo toàn quyền và ngữ nghĩa mount/device. Bổ sung coverage cho các ranh giới, bản sao trùng lặp, xung đột, đầu vào quá lớn và hành vi fail-closed. Hoàn tất yêu cầu có một quyết định policy có phạm vi giới hạn, tài liệu và việc validation thành công exact-build ARM64 NemoClaw trên AGX Thor và IGX Orin, cùng với các trường hợp restart, resume, rebuild và negative được liệt kê.

Problem

The native Docker CDI policy-enrichment path produced 301 filesystem paths for the NVIDIA Jetson AGX Thor qualification device, exceeding OpenShell's current 256-path policy limit before NemoClaw onboarding could complete.

The validation stack was #1606 through #2775, #2776, #2265, and #2846. A local 512-path change allowed qualification to proceed, but a blind limit increase is not a reviewed production solution: OpenShell must preserve a bounded, fail-closed policy while supporting legitimate CDI specifications.

Expected behavior

A legitimate selected Jetson CDI device can enrich the effective sandbox policy without exceeding an implementation-only ceiling. Duplicate or structurally redundant paths are normalized where safe. Excessive, malformed, conflicting, or adversarial requirements still fail closed with a diagnostic that reports the observed count and supported bound without dumping sensitive host metadata.

Acceptance

• Reproduce the 301-path AGX Thor CDI policy using a hardware-free fixture shaped from non-secret path metadata.
• Determine whether safe normalization/deduplication reduces the effective set; preserve distinct permissions and mount/device semantics.
• Define and document a bounded capacity that covers supported CDI devices, or replace the fixed entry ceiling with a resource limit tied to the actual policy representation.
• Add boundary tests at the accepted maximum, one above it, duplicate paths, conflicting access modes, and maliciously large input.
• Keep non-GPU sandbox policy and resource use unchanged.
• On the exact released OpenShell build, run the official ARM64 NemoClaw image through full AGX Thor and IGX Orin onboarding with exit 0 and no qualification-only limit patch.
• Re-run restart, resume, rebuild, non-GPU negative, and invalid/missing CDI fail-closed cases.

Current evidence

• NVIDIA/OpenShell#2846#issuecomment-5684128551 records the 301-path failure and local 512-path qualification change.
• NVIDIA/NemoClaw#8910#issuecomment-5684731268 records the accepted downstream ownership and release-gated validation contract.